# Title: Phishing URL Snort2 Ruleset
# Updated: Tue, 11 Oct 2022 00:02:04 +0000
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/

# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"+3efbf35a451aba8b1234b2016b5e4680"; content:"Host"; http_header; classtype:attempted-recon; sid:200000001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0.macrovpersonaso.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000000000000000000zimbra.circulosolidario.sv"; content:"Host"; http_header; classtype:attempted-recon; sid:200000003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"00000000000233.6194600"; content:"Host"; http_header; classtype:attempted-recon; sid:200000004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0007933738373.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000update.mytinyhomevillage.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000update1.alsgroup-eg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"001002005452133333.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"00200500145200002.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"002005410030210000.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"003accederitau0032.doluboe09.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0049731647300048374001.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0080005004466001.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"009877898767809999.start.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0110980880.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0150tree.xequcevusy.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0298762756926726.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"02ip.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0310f955.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03829gh.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0779jiadian.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-fdereewdwewweeeeeeeee.ezyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"090chw-3erbhg-vfenhwq-vcnw-rbvg-nwer-v9r4vfd.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09123100.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"094890-32839156.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bs.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g09rebqe8ms76om9oaq8oemd1t066ke0j725els0lpmpclkoh54heg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0jng0erjgf-e3wjr5gjnwsr-0gbhnjwe-0jrtghb-0j9werg-r9jgrg.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0nedrive-109709.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0olut8.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0pensea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0uj-yt08ty0-ghj-0j0gtycytyt-sdy-by9u-bb-nun-u9u.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook-shared-storage-01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0utlook.0ffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0v0.csokipari.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0web.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0x0c4681e6c0235179ec3d4f4fc4df3d14fdd96017.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0x6de037ef9ad2725eb40118bb1702ebb27e4aeb24.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1-sso-nifty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1.porseguridad.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795624.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000036598795628.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000x.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1019r5000f9200191ee89.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1023r5740f5200111ee89.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1023r5742nsserv1csecur1ty.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.155.93.229"; content:"Host"; http_header; classtype:attempted-recon; sid:200000047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.129.205.92.host.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.244"; content:"Host"; http_header; classtype:attempted-recon; sid:200000049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.248"; content:"Host"; http_header; classtype:attempted-recon; sid:200000050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10423584007000176.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104326535054541.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"107.152.110.21"; content:"Host"; http_header; classtype:attempted-recon; sid:200000053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10e20o30u37.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10messages.pending.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11110439868374784.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365585547384.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1112689753185922332.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11307dfb122022pak3s10.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.141.253.232"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"116.202.28.120"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"120901805221826-am.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"122128965729233.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"123123123123.misja21kajdsjd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"125498365683135466.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.11.214.173"; content:"Host"; http_header; classtype:attempted-recon; sid:200000066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.4.205.95"; content:"Host"; http_header; classtype:attempted-recon; sid:200000067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"143li.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1440-bih37330sxsrf-aliczsyxjquqf5igo1e6fm6s7n.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1446765768230008.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"147.182.137.233"; content:"Host"; http_header; classtype:attempted-recon; sid:200000071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"147.182.221.11"; content:"Host"; http_header; classtype:attempted-recon; sid:200000072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.56.117.104"; content:"Host"; http_header; classtype:attempted-recon; sid:200000073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14gqb.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14jlr.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"153in.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"154.222.238.46"; content:"Host"; http_header; classtype:attempted-recon; sid:200000077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"155.94.133.168"; content:"Host"; http_header; classtype:attempted-recon; sid:200000078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"155.94.146.45"; content:"Host"; http_header; classtype:attempted-recon; sid:200000079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1554656263221162222222.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"156la.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"158q9.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15e92.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15eos.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15fa6.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15mzz.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15twu.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15u7z.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15uba.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15udv.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"161.35.142.2"; content:"Host"; http_header; classtype:attempted-recon; sid:200000091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1611659748350570.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.0.237.154"; content:"Host"; http_header; classtype:attempted-recon; sid:200000093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.144.125.199"; content:"Host"; http_header; classtype:attempted-recon; sid:200000094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"162.222.215.185"; content:"Host"; http_header; classtype:attempted-recon; sid:200000095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"163-1ew.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"165.227.194.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1659761148350570.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"167.71.45.12"; content:"Host"; http_header; classtype:attempted-recon; sid:200000099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"172.74.148.132.host.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"174page3eprotectionsservic3s3curity.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"178.128.62.233.dsl.dyn.forthnet.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.43.141.107"; content:"Host"; http_header; classtype:attempted-recon; sid:200000103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.48.65.130"; content:"Host"; http_header; classtype:attempted-recon; sid:200000104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"180110116028.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1822direkt-team.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1822direktsicherheit.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"183.11.228.27"; content:"Host"; http_header; classtype:attempted-recon; sid:200000108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.191.228.198"; content:"Host"; http_header; classtype:attempted-recon; sid:200000109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"18c34ac2-fa7a-4b78-b7ff-ef204b07e192.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"190854.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.148.100.124"; content:"Host"; http_header; classtype:attempted-recon; sid:200000112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"199102481445514444.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1and1ionos.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1block-official.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1contaconline1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1e2e3f.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1gbbwuj32hwxig.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1iftbybcs28akuu.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1ihch.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch-io-stage-app-euc1.s3-website.eu-central-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch-v2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inchpro.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1lnch.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200000124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1monxt.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1npost-market.645125481.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1onos-by-1and1.dqutvshwrq6kz.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1stcreditbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1us0ps.30o6uj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.136.95.251"; content:"Host"; http_header; classtype:attempted-recon; sid:200000130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20-0-217-175.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20-199-19-234.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20-214-164-190.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.229.216.130"; content:"Host"; http_header; classtype:attempted-recon; sid:200000134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20101305090886952021.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2020mep.com.maiais.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200000136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20228787help54664support78.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20503022222044.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"206.81.15.214"; content:"Host"; http_header; classtype:attempted-recon; sid:200000139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2072596754663237747300.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.82.115.230"; content:"Host"; http_header; classtype:attempted-recon; sid:200000141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2080-0513905-70520.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"21680-4167.s3.webspace.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200000143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"217651.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"22wsdnmdegqiara6biw144088bih-73578dpr2.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23.224.61.142"; content:"Host"; http_header; classtype:attempted-recon; sid:200000146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2345.controint1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"234578.controint1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"237558763284658.9755436.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23890567189562362.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23b.rhjac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"24764.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"24electrician.245.mrsmartprinting.com.my."; content:"Host"; http_header; classtype:attempted-recon; sid:200000153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"24xchanger.cash"; content:"Host"; http_header; classtype:attempted-recon; sid:200000154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"25a9ff8c.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"27618-zaplata.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"276ba.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"284965f5-7be3-40e1-b93e-92366ea5fce3.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"288.rolandobonillarealestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"29-09-vewrbverbverfvb-fdvwergbergw-rgvfhwer-0ghv0-dfv.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2914hawthorn.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2919b233c1ea8fde21529cd0bb040be4-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2938675358256483.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2ac08924.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2amzrom.co.jp.zdaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2dr.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2fa.bthei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2n.k5wn.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200000168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2wyslijpaczkeip389184.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2yyjq-ciaaa-aaaad-qeabq-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3.92.0.79"; content:"Host"; http_header; classtype:attempted-recon; sid:200000171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3243gr9r3h2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"32515641313215456.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3298re09432.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"329dc.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"342535125624124756.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"342535125624124756.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"346497.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"34839783344hg5566.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.192.38.184"; content:"Host"; http_header; classtype:attempted-recon; sid:200000180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"351432894574850002.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"35ba3c6b-b09c-4896-9bf5-4c911dbcf9a0.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"370.pef.2575.conscientiouscapitalinsights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"384a09c4aaba5de287d1dd83580b4eaa-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"388e03bd-b022-4448-8099-79af0fda2f69.mailbutler.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3a141a26-3f99-4729-a07d-d79506a1ed3c.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3cmob.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3j124.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3kq1.tq7p.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3landers-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3pgeneralcontractor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4.227.137.244"; content:"Host"; http_header; classtype:attempted-recon; sid:200000194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400cgpe9ftgophh71dks1uopj54felhbrbg9iv21eagktj8435lmdp8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"405capital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"413r74sn0t1f1c42345r4.ajfudff.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"416522000123897.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"419gbmuab-d4195.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"42e2391f.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43434.5465654.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43gbr-vfck3we-5rtjgk-wrkjgv-kwe-tbjgh-werjkv-f09-fd.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43gf948h3s.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43qf5-qqaaa-aaaad-qdaca-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"44speed-mart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.55.167.181"; content:"Host"; http_header; classtype:attempted-recon; sid:200000206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45768887.495745.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"46c7829bbb3b4907a075841dd98a883d.v1.radwarecloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"47.89.49.243"; content:"Host"; http_header; classtype:attempted-recon; sid:200000209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4710463d43910.bonactech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"472fbwpwbsnsl.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"47b117c9-cdf6-4030-b5d1-90a96edcd3a1.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"48519283-86de-4ef6-9db2-7be27af47c73.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4bx28w.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4ccountid3nt1tyhl3psp0rt1122.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4iahkbvl1k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4mvbjk7gubjkuh7grbmbfrrhnbh7fckbbbbbbbbbbvvvvvnbhuujjn.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4pforange.byethost14.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4season.com.kh"; content:"Host"; http_header; classtype:attempted-recon; sid:200000219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4tgh0-984608hg-0e3hrt5ng-0ewhnrg-0hnberg-0.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4w8bmmjcw86e.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5048400080.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"51.222.218.236"; content:"Host"; http_header; classtype:attempted-recon; sid:200000223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"51.75.71.30"; content:"Host"; http_header; classtype:attempted-recon; sid:200000224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200000225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"52.20.22.249"; content:"Host"; http_header; classtype:attempted-recon; sid:200000226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"52.229.224.250"; content:"Host"; http_header; classtype:attempted-recon; sid:200000227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"53vzxcnk6rwp.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"54289993039409563.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"54545454545454.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"546782d6.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"549wt515b-d5495.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"550186login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5578805078050785078i.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5646854132103213561453.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5667566098886665477.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5688785462648234708.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5apps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200000238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5e-ming.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5esport-pro.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5tu.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"60.51.93.180"; content:"Host"; http_header; classtype:attempted-recon; sid:200000243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"600500100025463555.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6128565463651654.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"61da8ae6.6u6566hrrthsh45.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"62797d44-003f-49b4-b426-7596edf0a137.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6424login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6455441564164.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"64563login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6476927823772099930.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"66.212.22.201"; content:"Host"; http_header; classtype:attempted-recon; sid:200000253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"66456465454514.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"66bl4vk7pbiwxkazmdfqgu6onyhsoch4dbdvllo4u737jn6wu36q.arweave.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"67.205.181.48"; content:"Host"; http_header; classtype:attempted-recon; sid:200000256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"673925.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"676576537.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6767687.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"67889562325a.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"68.183.201.58"; content:"Host"; http_header; classtype:attempted-recon; sid:200000261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"69830weqwq.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6a122289-f2b3-48db-af3a-3325b5a88bce.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6f0a64a6-34fd-4f0d-8137-331a9a7d42d6.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6kvme.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7-10-frvbetbghetfb-erdtgnbrfyhnedtrfb-deftrbdefbfb.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"70221289657292.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"71b2edb8-08af-4eee-8b95-8127599b2ace.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54362.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72352723-54363.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"72horas.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"73251045-06f5-4e2f-958a-65269b616616.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"74233c62-ed4e-4e44-ae7d-ff0819ff707d.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"750shein.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"756445t.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7567585662116566.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"765gh58login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"766320.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.108.89.240"; content:"Host"; http_header; classtype:attempted-recon; sid:200000279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"780030.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7848478.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7b082.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7cf3fd69.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7dbe4fff.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7fusw1fl.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7g.kz1g.abruzzo-food.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200000287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7rgwearv6pm1.askher.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200000288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7webabds2e6dgmp4g34count.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7x5dvh.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7yu3v.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"80880568352345467899.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"80j-0vfckw-efrjg-wrmvewnrbv-0wmnvb-0r9nj-09rv.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"82v8b.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.212.106.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"84e48348-ea07-4b49-870e-042e0751abe1.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"854.optima.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200000297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8665hu8login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"870008720010087.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"873734349834.start.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"873twc.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"878t87.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"892y3bdf89ewn6r3.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"89888756.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200000304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8ac0a.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8auahx.assertiviadoc.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8d7af84c.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8dd401c2dbf4c414704450bd2b72fc89-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8g5034gj-kjf-wkrg9eh-5th-8rihw-jf-wer-fjwr49jf.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8liens.start-premint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8tp5b5.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8vs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8zk81q.pcloud.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"90rv-gfke34-9j6tyh-ejvgf-09ejt-0vkwr-0vkje-0tjb-09rv.obs.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.204.144.8"; content:"Host"; http_header; classtype:attempted-recon; sid:200000315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"943151c8c3ad.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"953842galiciaimportante034032.caro1313.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"98485login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"98498548949851984.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"986821122128965729233.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"98788.98999.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"987ya5rb6login.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9966a.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9ftytucsh4ph.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9janewshub.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200000326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9y3ihoda.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a-t-t-106142update.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.60b7ac265566e3da4341f765b2d2a73200f8f1db57b0b005a1afdc00.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.dab342ab8887461995aad393cb294948a5ce800ca279cd1027026d47.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.eddyx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.gibsonwine.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.insecurpage.recovery-safty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0570626.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0c1qtplk5knjp5jsmpk96nm9sqd7xk87xzjx79yug7f0.ceo19662572.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0w0kt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0zxa3.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a15xu1.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a2e2d331-80b4-499e-b24e-14af8aa3a18b.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a35b65dr4e98a5us.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a35b65dr4e98a5us.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4be6a33-a2a9-4b0f-ae04-71f23b9a45c6.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4d3b42c.chgmar-d8y.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a5d803bf-d881-47bf-870b-2616b10208b5.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a71843c1.mailssocloud-srvr65e5rd.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a76uh-rqaaa-aaaad-qcycq-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa52ea7e73864.bonactech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaa33f221bff69e7c4f0cb9ad1b3d53d-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaa33f221bff69e7c4fecb9ad1b3d53d-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaaa-9qg.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaasfgtfgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaatradeco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabbccee-86c0a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabbccee-86c0a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabgdqagom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabqhaygas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aabwszchqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aacitqvaeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaczmvyqhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaildmstul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aajkabahujanmedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aakjfshncw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aakrgdwtxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aakyhjbtba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aandjstudios.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aap.org.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapivvqwiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aapks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aarr.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aasapiubpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aasdygsolf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aasoelpwnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aatffuusjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavainvhmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aave-finance.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavedefimax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaveexs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavelc.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200000379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavelend.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavesr.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavljemsbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavomrksmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavuppqpsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aawrvhxedd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aazodeabyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ab.galeish.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abacuscollege.qld.edu.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200000388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abastecedora-agg.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200000389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abatedsbqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abbfxwdwml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abbwvvzmlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abfaevlptk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abfrdledkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchabnn7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchabyte6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchabyte8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchabytr10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchaite4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchaloi5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchamm3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchavgzx2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abigcaptchaytr1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abikytravels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ablomuclux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abncra.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abnzqhmvfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abomfwszks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aboutpuck.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200000409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abpijwutyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abqlfivtyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abracadabra-walet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"absakenya.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"absolutepleasure.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200000414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abswclpbgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abuelacassandra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abvtzjepqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abzxwmdrwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ac-rukaten-bank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ac0untp4gec3ntral4ct1vitycovu.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"academia-rennersolucoes-portl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"academy.thenobleguardians.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeeaaen.aseaesasen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeenen.aseaasen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeesaaeen.aaseaensaasen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaeesneen.asaeaasnean.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acagudpqrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosaaen.aseaesosen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaosnen.aseaosen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaossaaeen.aaseaensaosen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acaossneen.asaeaosnean.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acbbmmaorq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acc-aave.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaaaon.accoesccsa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaeon.accoccsa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccasaaeon.aaccoensaccsa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaseoen.acacoccnsaa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaseoen.acacoccnsaa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccaseoen.acacoccnsaa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceaaon.ascsesccna.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accceson.ascsccna.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccessoen.asacsccnnaa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acccessoen.asacsccnnaa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accconfirmationpage.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedi-area-clienti-web.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedibper.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaen.aseaesccen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.accaesccsa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeaaon.ascaesccna.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeeon.accaccsa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceenen.aseaccen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceesaaeon.aaccaensaccsa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceesaaeon.aaccaensaccsa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeseoen.acacaccnsaa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeseoen.acacaccnsaa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceesneen.asaeaccnean.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceeson.ascaccna.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesconnexionpostale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acceso-galicsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesrewards.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-bankid.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-verify9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdn7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesscdns6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessingrenewal10622.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesso-web-sicuro.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesso.clienti.sicuro.eshteghalepaydar.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200001856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobperbanca.relianceplacements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobperbancaweb.cloud.cpanelbudgethosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessobperweb.lalpipra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessonormativadati.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessreward.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessthepooc00in.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosaaen.aseaesccen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accosnen.aseaccen.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accossaaeen.aaseaensaccen.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accossneen.asaeaccnean.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accossneen.asaeaccnean.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accossneen.asaeaccnean.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-access-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-access-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-check.co.jp.eektrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-info-review.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-restriction-1000456867.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-restriction-1000456867.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account.verifications.help-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accounting99c7.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accountingcorporationbi0.corporacionbi0.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accounts-center.csnid10000006519111.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accounts.thehandmadepaper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acdemy-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acdmyuouom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acecessobperweb.silvercanvasstudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acess-ofici-fatura.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acesse-hiper.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acesso.meupersonalite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acesso.upliv3lo.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200002083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessocx.3utilities.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessodedodemo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessoempresarial-emilio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessogerenciador.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessoibank8.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acfhhpzrla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achadinhosdashopee.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achat.pay-sas.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acilebanon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acjtvfzhvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acknxyqzlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aclceqipmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acmlkthnec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acmrmeekzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acn.unpbls.sprt-acn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote012.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnote012.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnscure.cnfrm.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acordion-stela.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acorhxcyuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"act-premco.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activate-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatesynmainnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatiioncode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activationesword12345.todossecurecion.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activbancolombi.activbancolombi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"actividad2free.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"actualizacionfinalizadasystem3.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"actualizardispositivo.webnode.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200002136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acuascut.bluehoststaff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adamviral.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adanew.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adapps.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200002140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adas.lacorre.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcapitals.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcloudserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcocody.ci"; content:"Host"; http_header; classtype:attempted-recon; sid:200002144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcqgyzhye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"addoha.ci"; content:"Host"; http_header; classtype:attempted-recon; sid:200002146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adept-producer-5628.ck.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aderiamo-subito-al-nuovo-protocollo.solifapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aderiamo-subito-al-nuovo-protocollo2022.amdigitalservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aderisci-al-nuovo-aggiornamento.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aderisci-al-nuovo-aggiornamento2022-bper.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adesnjgrt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adf-105772.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adfpbqgbmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adfqexftsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adfqmqfltw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aditional12984.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adkmtaofpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adkovgdcmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admdeqebww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin-formserviceupdates.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admissionbackend.umse.leads.edu.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adnflhmdbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe-viewer.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe1-2536c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe2-d56fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe3-3e1fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe3-3e1fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe4-3803b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobe4-3803b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobepdfllc.mypixieset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adolescentwellofftechnology.cholin.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adonaibaibul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adorabledaringplots.230922.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adoring-feistel.52-65-164-78.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adoxkufmcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adpsbylrzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adpunemploymentclaims.sharefile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adqtxcurwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adrayvllqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adroitorganicssmartexpress.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adroitorganicssmartexpress.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adrreereft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ads-manager-case83400917.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adsnlzwjfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aducztaeqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adv-promote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advancelink.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advasmi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adveninternational.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advice-myenergy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adwoplok-investing.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adyikfmiso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ae.centralhills.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ae95c053-c0b9-4695-a2ff-ba2040d631ad.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeamfwgouu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeasdf.org.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeatzcqalq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aec02ussba39485auth-yahoouserid4734.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aefyouiagz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeirwkzqtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aejmuyfnsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aemazon.co.jplogindfs3dg5hcx.bjktg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aemwfueger.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceaaon.ascseseona.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeocesaaeon.aascsensaeona.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoceson.ascseona.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeaaon.ascaesaona.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeesaaeon.aascaensaaona.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeeson.ascaaona.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoeessoen.asacaaonnaa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeojseufnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-card.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-dudu124.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-japan.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-japan.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200002614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-japan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-vip.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.1vgdu4.afojigtsuy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon010.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbamk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbamk.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200002620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeonbask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeropartscr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aerospacesses.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aervatxwaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesexdvomp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoesn.aseoseseacn.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aessnuxhff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesszyhvgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aestheticclinicgroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aetaxapvgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeterlljxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeuxemazee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aevpk.rarwise.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeyjwvwsfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afainatenci0nclie.usselses211s.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-reset.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-sms.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-sms.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcu-support.cloudns.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200002640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcucontactuser.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcuonline-c5067.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afcuwebbcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afdewmayna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afeadfgc.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afedgyybrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affectionate-jackson.176-113-115-105.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200002647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affhcsognz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affixwallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afflaffokh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affordablepetcareatfourcorners.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afftxfncxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afg43545.sdfgdsf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afgrznpakt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afkgukpvjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aflgqiyqsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afp--futuro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afpufalsle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afterpay.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aftral.8997.tetline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afursxbloe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afvadbscgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afyllyqhku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aged.anapeck.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agence-88069.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agence-88069.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencenote009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agencesgwn011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk40710.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk69875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.deutschemkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.kpdgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ageth.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ageymxwncz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aggiorna-spedizione-bs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aggiornamento-verifica-2022-ora.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aggiornaspedizionecartebper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agihcdllbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agodarentacar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agoodcorner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agoowbwhyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agqpkdqvzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agreatstaffingcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agrhsypjxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agri-cole-fr-t-i.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agrnbimyqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agroblockchain.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agsjexrnlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aguiamotoslem.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agukrdhnzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahadconsultancy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahdkmotgne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahftovzxnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahhckfxpgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahhhh.pe.kr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahhnfjt66.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahjrdolpav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahkoectwzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahmjxbykeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahnczrpyqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahoohztvts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahoramismo.vista-it-support.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahrmiaqnhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahrwysumdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahttlnwxng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahvsfcnpnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahwyuussia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahxfgfexqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aicajgkdyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aichi-bp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aicjsnpzur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aidymfbdni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiebyxtuzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aigealtodu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aihbuvcafi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiirugvazn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aikxfusfyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ailapersonalloans.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiovsbacwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aipufdwjlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"airhohvvtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisqbxwjes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aisvqefsfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aitkbbqnud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiwgwjxzfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiwywwfvwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aixlsfvaka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiyiwkkash.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aiyykjkizw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aizik-whatsapp-firebase-clone.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajbhxkdzwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajbkvpqyyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajfbjtquph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajhrwfrkiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajiczhhrjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajiostores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajirmgcxsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajljxhqvjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajmjnlitkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajobfyboaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajpvejcrod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajrbzfsbbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajrgbkxzxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajtduavdyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajudacontabilsadv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajvllhahpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajvxoemtoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajwaxfnoux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajwucjzfny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajxsqclfwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajzjorufpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akamdebrzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akanksha3012.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akatale.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akbzdcwlxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akcrsjvkwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akehbmhkxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akemidentalspecialists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akeqdevmup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akhvaairmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akjhfxpjdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akjqzrruct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akjrjgcfnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akjsu63646habfh.125mb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akk.liyuan158.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akljfmymnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aklmuohgfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aknpouubin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akotjspqtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akpfxvdhfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akqlyuxdaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akqvvtnzdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aks34.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aksamqhrhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aktualizacja.jst.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akueipwupb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akunwnrsrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akvscutceb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akwhskpqpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akwuusfjdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akyygteqqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"al1l1i.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alacdufens.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alaiabelize2067086350.applobe.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alareentading-catalog.page.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albaraka-bank.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albe.abeer.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albel.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albertoliviera014.outgrow.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albertomingueza.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200002802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aldana.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aldypszesl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alegrolokalnie-delivery.3200052.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-accesoclientes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-inter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerta-novobanco-movil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertabangrupo.alertabancolo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertas-bancofalabella.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertdavipla34.davipldoug.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerts.department.improvement.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alexcolife.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alfatrjhtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alfjlqyvnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algazeliya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algotextil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alialinedssc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alidaled.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alienfrensnft.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alimentosybebidasrefrespul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinafischer.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aliniwohi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinstantecon.imprenditorecomunicatore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alitjvycme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alkhalilgraphics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alkhoornkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allbrowardanimalremoval.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allconeirnf.wilsonleon.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allconnect-hub.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200002830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allcountylandsurveyor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegr0lokalnie-delivery.8099096.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegro1okalnie-informing.8712456.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokal-dostawa-pl2773.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalne.86594345154.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnei.0224545.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnie-merchandise.321225.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnie-purchase.423960.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allegrolokalnie-shop.7548512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie-shop.698745512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliedschoolsahiwal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliiant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allmarksintl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allnodeauthenticator.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200002845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allo-system-drrmrrr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allo-system-drrmrrr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allstarasbestos.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allyoucanget.dyndns.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allyugrqug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alohacafe.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200002851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aloyinloko.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alpacadabraz-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphaazaza.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphagang.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphakongsclub-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphanumericmediumbootstrapping.georgiepm.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphasharksnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alpjzxonqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alrbmptlke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alsarrajjewellery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alsofft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altecmetalltechnik-energiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"althpotaqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altruisticgroundedassemblylanguage.informesga.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altunhaliyikama.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aluhqyzkwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alwwbebmqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alwxqcxvus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alxgxohtic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alxstqccml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alydsdwekb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amankan-akunn-anda01.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amaomkeexg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amaozn.ywcimei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-interruption.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-jpcs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.791km.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.bfdep.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.bfdp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.ca.jp.accountdomainmanagephp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.9ywz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.ot3k.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.ep.xls4nyhx.llwh2cjb7gd.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200002884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.hnxfcy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.hwerr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.lakurz.cedjfpe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.mojpac.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.mojpaco.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.mojpc.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.wnuvset.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.zp29.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonline.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonsp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazxcijfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambari.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200002896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambilchipsedekah.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrrygen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrus-studio.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrygen.care"; content:"Host"; http_header; classtype:attempted-recon; sid:200002900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amc-training.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amcol.ac.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200002902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.dgeryrhh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amczon.co.jp.khgfdsdfg.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amdjalepo.itenlo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ameli-espace-maladie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amelicartevitale2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amelie-carte-vitale.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ameliesecurity.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amer-group.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirst.d1w.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcu4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcu4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americanalojas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americanexpress.ceartavimbomukiccom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amex.neraida.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200002918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amf-sign.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amh.takeoutlive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amidabuli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amirhameed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amm-uni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amm.kiichi777.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ammyadybad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amnaamqccc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amoanza.co.ip.silvasdiical.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amosleh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amowldrqdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.dfgjkfg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amozon.co.jp.regxgi.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amphibological-coug.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ampliareis.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amppleter.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ampunbanaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amreeth.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ams-shared-11.hostwindsdns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amtrakaccount.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amurjxhprk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amurlso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amuysmkore.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amwqmxhozs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amxjzemcft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amzanon.co.ip.pedfrewro.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amzpqjliln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"an-app-magiceden.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anandsr-dev.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anantaseguridad.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200002948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anapolisemprego.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anarchitecturestudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anasathalassas.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200002951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anata-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazedemyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.chyurv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazom.co.jp.xwsdh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-glade-76e4.tralside5454.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-morning-2521.wabrestroom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-quee6173.tmp6n9c0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-voice-a281.attnetmms78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient.tybocas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancientheroes.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andalusstudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andriaz1700001.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200002963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andriaz1700004.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200002964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anesthesiaqbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anfntdmicz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anfseholzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelydigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angindatanglahh.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angle.niceous.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angrycat.your-mint.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angrycatnfts.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angrydinosnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angxwsnsqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhfrnohqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anhgndslyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anibis-ch.protect-pays.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"animashopping.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"animemetaversenft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anithbetique.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200002980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aniversariotramontinaofferte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anjalijha167.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anjuzdggfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ankiety-konsumenckie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ankitbadigar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anmdkkscty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anna-bulldog.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anniemccane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anomaliarestrizione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anomuranft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anonymice-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anotuorqoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anphatcompany.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anqudlwsbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anrkoatxbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anrremovals.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200002996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ansrbuovhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anthony-smithlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antiquepopcornmuseum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antlertrader.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anxoonxhzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aobajcydix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aofnasyexj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aofokmuhte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aofywjkcww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aokgxglbif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoki-gp.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200003007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aokkkfhzql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aol125393.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoldomainbook9service.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aolxperience.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aonjhgjixd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aonuer57.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aootipoeti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoqqirvvqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoraitbnnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosadowpvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aourycjpxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aovuuktlbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aownzsasc.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoxotfdxlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aozorabank-czsg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ap-bogged-fi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200003023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ap-bombcrypto-ol.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ap2fws723gubed68wi3e2g38col3g86tdgsx.agency"; content:"Host"; http_header; classtype:attempted-recon; sid:200003025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aparato8qw7aa.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apavoormfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apcntwkvlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apdpqsspyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apdyjqrbcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ape-club.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apelive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apeplanetclub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apexprotocolnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apftnfufln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apgixxlfsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aphalefwye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200003038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.saisoncard.co.jp.lfesl.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.saisoncard.co.jp.wmqp.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apiens-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apiens.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apiwhesgooe4560.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apjryicjfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apjzblvgxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apmzsaop.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apowewbbto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apoyosbienestar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app--bombcrypto-io--acess.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-activator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-aloalmio1.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-aloamon1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-axie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-bitkub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-bogged-fi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200003055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-boyle.lrcyskwntx-yjr3odrvr61m.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-boyle.z7dzfbmm4d-xoy4wn7gr4pw.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-feeney.uyrdgvqh4r-zng4pv7mz4dp.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id6016.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id6016.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id8109.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-id8109.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-internet-dbs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-magic-eden-x2x.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-magieceden.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-mobox-login.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-poly-g0nwebsite.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-purdy.lrcyskwntx-yjr3odrvr61m.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-sauer.lrcyskwntx-yjr3odrvr61m.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-stoltenberg.eeve4e0gc7-yk26evzeg379.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-sushi.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-sushiswap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-syncsaffix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-turner.z7dzfbmm4d-xoy4wn7gr4pw.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200003074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.aavve.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.assessmentgenerator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.buytamadogies.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.fatucredi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.flowstringapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.formbuilder.ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200003080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.gruppo.smartweb.rjmey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.hubgdpr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.importsnode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.importvalidator.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.instantfix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magic-eden.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200003086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.magiceden-hello-nfts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.moneylinecreditcorporation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.pncservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.singlelink.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.speedywaiver.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.sugarsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.waiverforever.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.walletmodifier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app1-mps1.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app42.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200003096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbogged-finance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbtcommunication-hub.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appcef2022.10001mb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appcomunityupdate2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-check.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-check.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-checking-109232.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-checking-109232.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-10034778951158.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-10058946773156.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-10058946773156.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-1006428794632.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-1006428794632.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-10073846583.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-status-10073846583.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appissueresolve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-contactless-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-suspension.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple.co-sm.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200003115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple.rcp1.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200003116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"application.axisbank.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"application.cardinvite.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"application.cardinvite.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"applogin-bankid.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"applogin-bankid.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appora.sviluppo.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200003122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apppxqbkmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appreter.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200003124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appriver-voicemail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"approva24.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"approve07b-auth3469.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apps.ipae.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200003128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apps.qattanfoundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appshiberswapp.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsuite.currentplug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appwonderlandmoney.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apriegkzay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprjoafuol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aprobadoahoraaqui.usedcomputer.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200003135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apsei.org.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200003136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apsewas.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apuhziqnoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apuqowlmxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apwhtdqknx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apyyzihiir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apzrpamhbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqbllmuwmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqbshkxyxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqcdrnatsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqcgfryvrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqdeppibfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqirdkpxag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqjcqrobts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqljrmyavx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqojjrewrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqsckmacqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqtvbsvxli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquaboil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquarelle.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200003155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqvifincny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqwdyiylww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqwpdhetib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqwqscmeak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqxgolqiqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aqzmpbtdjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ar-rvest.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ar-rvest.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ar5cz6.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arabianoasis.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aradjbtxtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arafathrumman.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aramex-confirmation.com.ae.shubhkarman.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200003168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arcaflatroofing.amdev.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200003169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arcapply.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200003170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arcbbeovis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arch.skulls-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"archcupbearer-isothermic-viver.s3.eu-central-003.backblazeb2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arcwpinvzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ardorcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibper.theamazonhelper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areadocliente.jelastic.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areainpsprivati.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areapersonalewebmps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areasmartbpercard.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argalicia-clave.supploc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argeonppfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argoconstruction-auth-0ffice365-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"argoconstruction-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arienxtidd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arkhtujfve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arlindovsky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"armaghanenajaf.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"armlhfebpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arnaldolanches.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arojzgeeqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aroundupapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arproofing.walywyfiw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arqqgmsipz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arre-9do.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrozsabanero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artcnsinoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arthamahotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artsiluette.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artstil.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200003200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arub-service.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aruba-authenticationserver.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aruba-authenticationserver.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aruba-pec.hausendruck.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arubahosting.comminicazionstaff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arzmwazrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"as-uni.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"as9192030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asa-q98.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asaqejshqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asbjvcdwos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaaaon.accoesoesa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaeon.accooesa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaseoen.acacooensaa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asccaseoen.acacooensaa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeaaon.accaesaesa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.aajgpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.agogog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ahgcef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ahtzjy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.aofwip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.auaynk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.axnsac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.bfuamk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.bpycae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.bqdttb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.byddyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.cabycv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ccfxga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.chgcvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.crhdbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.dhvppl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.dotmie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.dtdent.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.dwxgub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.eakwzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ecwqvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.etfode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.euiddi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.fghgux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ftjaie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.fxdrqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.gnhqcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.gpypor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.gtwkyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.hijfcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.hkvydr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.hsjtfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ifqxct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.iidvtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ilgeku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jhmkue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jidlaf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jpvnhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jrgxnf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jsyioj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jtrejs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jutyeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.jyshzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.kqhhdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ksmfpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.kvufus.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.kwueve.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.kyvggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.lnntsn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.lywswi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.mgveds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.mhuakn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.mpxuis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.mzhyjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.nbzxlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.nhmobe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.nwnwpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ofgnzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ostzoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.pobeck.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.qifvbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.qvsaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.qxykiz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.rdotfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.rhokdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.rjzjny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.rzopzy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.sigxvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.skahgj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.slkymi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.thipyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.uanwtt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ufrico.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.uyylmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.vclotq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.vlfhkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.vodlvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.vplhow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.wcxbpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.wkjagf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.wkjema.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.wmtgsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xelvgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xfcbpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xfflrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xosxbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xqimja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xrhzkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xwipxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.xzoosw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.yjmokp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ylssuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.yoslwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.yvfari.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.yxdwbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.zcefqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.zcjwnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.ziaxaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceeeon.accaaesa.zzqnrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asceesaaeon.aaccaensaaesa.sxxtpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ascen.formazionefad.fingeco.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200003615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ascqwgfekd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asctvbwgzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ascxpzckkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdas12dfw.line.pm"; content:"Host"; http_header; classtype:attempted-recon; sid:200003619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdfghfd-103701.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdjqlleis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdrewd.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asesolutions.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200003623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asesorinformatico.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashley-hamel.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleymadison10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleymorrowsh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashlylealsh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashpazieana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asiacoregroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asicpod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asiztlbvgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asjpylvflf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ask-cg.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200003634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"askarmotorluaraclar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"askorw.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200003636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aslvcizzwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asmnkayxoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asperpaid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asroqqcppr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assessoriabradesco.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asset-file-project.files-secret.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assetcolab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200003643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assets-project-cloud.reconfirmation-zip.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzaanomalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzacarteweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzaidentificazione.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzanormativaclienti.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzaripristinodispositivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asson.etamorocco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asthagold.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200003651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asuntox92929.verificacio19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asuransikita.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200003653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asxizdewka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asxzcse.4tv9m0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asymvaprib.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asymvaprib.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aszxca.plgdcu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200003658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t-mail-9a8302.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t-yahoo.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at0.srev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at911ma.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atamaofficial.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atarix-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atbpknkqno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atdenforgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atendimendohyper.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atgaachjse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atghlueqon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atiotem098.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atksdqazqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atlantacolocation.services"; content:"Host"; http_header; classtype:attempted-recon; sid:200003672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atm-i.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atmosdesign.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnhyldecm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnkfeoibu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnr76dxku336szy.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnsszxzra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnwpgxiwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atootqebjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atplert45.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atplxvtjyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atshop.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atsnft-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atssnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atsuko-inoue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-100018.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-100066.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101212.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101378.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101658-105318.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101718.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-101980.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-10225.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-102256.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-102327.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103175.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103193.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103289.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103614.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103704.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103985.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104021.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104318.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104361.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104619.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104624.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-104931.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105231.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105286.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105606.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105742.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105765.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106038.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106161.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106290.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106415.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106541.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-1068281.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-107099.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-107934.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-108073.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-108316.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-10842.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-108612.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-109150.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-109330.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-109354.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-11.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-201022.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-2121212.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-domain-104674.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-expired-4de4.att-expiredms1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-free.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-022-103159access.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-100369.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-104774.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-106766.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-mail-107649.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-online-verification90.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-online-verification91.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-online-verification92.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-onlineupdt.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-signn-in-105644.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-support-70965-100266.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-support101320.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-team-100932.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-team-105195.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-usermailler.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-verification12.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoo-107455.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoo-109133.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoo-customer-service.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoo-mailing.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoomailupdate.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahooupdater.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att1.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attaccountunmask.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attaccountveri.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attacker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attbellsmondss102922.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attclock.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attemailongoinupdates247frmit.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attemplate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attfin.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attgdbhdt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attinterserverupgradelite.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attitsupportsystem.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attiva-app-bper-ip.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attivadati2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attkgfsdwuye3weyd763yaadisz.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attlogi-inpage.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attlogiinpage.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-103691.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage-1084624.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attloginpage0.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmail-100378.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailboxaddresss.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailerservice22.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailinfo.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailservice45.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailserviceupdate-103969.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailsupport-100610.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailupdatecurrently.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailupdatemailservice.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmyemail024.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnemt54.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnowemailupdate.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attserviceupdate.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsever-us.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsupporrrt.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsupportingmailboxxx24680.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsupportingmailservice22.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsystemserverrr.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attsystemserverry.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attuehh.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attupdatemailservices.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attveri.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attveri.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attyahoo-107730.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attyahoobhg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attzcxffclfjlggflggghjjhjljhjjhhk.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atukgohosf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atvdpdhggw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atvniuglif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atwsckdoee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atxpticbbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atykucpsyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atzneczslc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-0002.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-login-service.signinau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au20th.adobersserl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aucieigzyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"audience-upholstery.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"audio.mellatmehrgallegrolokalnieaaa.aaadmin.derinport.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"audkkthvxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"audszvpnkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"augustvollrene.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auhognzxyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aukfxnvmbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aukqosuzrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aulavirtualmibanco.freshdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumenta.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentdisp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupo20221.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupotuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentodecupoh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumxuobydk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aunment.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aunrvuluge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aunter.onsitrx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auoijiyqfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auomupwejd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auorlhaaxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupikvhhhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupxdhgnmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auqbqrptrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auraschoolpmna.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aushonqpfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ausps.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200003842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"austinl33.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"austykvqvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aut-jil-f7dd.dmarce.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autentica-20304.dreamhosters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-alertusps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-arvest.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-arvest.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-cyberlogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-document-shared.datingg-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-flcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-flcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-huntington.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-huntington.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-a0wegaftdizq01m4ol7x9976r5guh8zj2qynugjo.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-chbn3ui09o73cnml1umrvyk77zkuapcrlu5xxeg8.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-dixd8l4w4umrzadx5ruhx8tgix0gml37lmtpxub09gbo7.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-hczd80h2ld3lkdndf6619l0rny21oqr6m6unt8scpiv5y.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-q5v7bitmwxbzj3yjcgi2v1gvsakvuqrvvjjlvr798czzc.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-user.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-login-user.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-01hj4s1r0qa4joet2ubr560nhq292n5yynhqdvfq1w158.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-1926e72f9ssyq66rod6pp1brcxa21br6n87dr8ks.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-60bszfwurhb6e2spiul9bs8c99rbjzq5aoroi12a.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-aiqoo4z1qacqodq3vv1t79dr9pasn795yzep6k2dk5kke.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-nri1wv4pjkovbrai9k9vf0dbuntcr6506rdi26loo2s53.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-ovy86i2igkp45g6ao6ux7a2y10q4057hf8m9v0lg.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-sign-w2shd0wwd6k9h1bnrc7wgytvbvkmbtcolbymul8ezw3uu.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-task1-m.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth.secure-bigpond.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth0sharefid0000000200000ff1ce009id31d2bb9c.auth0rizesharedo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth1b-jb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authappsolvedapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authb-jb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authdnb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authdnb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-0oxsoxauthe.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-login-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-login-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-user-online.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-user-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticyellowgreencomputing-1.suporwre.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authentificationpaiement-servicesecurise.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authhunton.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authjp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorise-id-apple.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorise-id-apple.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authorizecontract.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200003892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authuxeehmutconjxmailssocl.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autodiscover.ryder-dutton.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoexpert.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200003895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autohauspodcast.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoinsurance.penny-stocks-gps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autorectifytoken.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200003898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoscurt24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autovalidatechain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autovinmotovan.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoyamdp.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumn-cherry-0625.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumn-sun-4a21.paqesads-scure.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumnxflash.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auugycnnat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auutegdgdg65.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auutegdgdg65.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxovfuyge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxxxxxxxxx.smb.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200003910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auzngpyzaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avantilovekc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avdmornifi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aveenbv.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avetlikhqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avexwkbtcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avffulgtoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avgsrzrpgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avgummwpap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avhostings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.7sq5xol.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.arbzal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.daoxal.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.fbcsrf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.gpnzgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.kfeyef.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.lhrlkr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.oxo5uzj.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rlemhb.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.tbbahr5.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.udbgrm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeaeasevcercreoi.viiavucrrnsvscrroieeaio.vgrsaup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.6ah1rxz.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.bv6u6sw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.cfmmcc.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.dcggok.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ecoi15j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.gbrjfas.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.goinjd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.hnzbsyi.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.pqxamup.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.xyrmwug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.ydj2q19.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveeseasevcsrcreoi.viiavuerrnsvscrrsieeaio.zox9nus.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.1gdr53n.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.bomvpw.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.mjgkwb.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.relwog.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.sgakhql.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.t0ec6bw.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.xkukewn.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.ybmykhr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacerceeoi.viiacucrrnsvscrrooeieraio.yijxdrm.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.9m4ymbi.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.hqmwm27.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.pknnlio.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.rqgjzca.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.vgtkezc.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200003974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avicacveoseaseacsrceeoi.viiacuerrnsvscrroseieraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avisaboneee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aviso-itau.kinahost.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avitalagro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avizkyyltm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avlk345hlak.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avlk4jtga.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200003982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avlvcemetw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avlyixanyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avnoxaoaei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avpuspwfwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avqrvezwdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.9m1dx7m.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.axvpsr.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.ayynuu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bjbh03z.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.bjlhhf.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.cldtta.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.nwey3w6.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.sxgakd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiaeaseccercoroi.visavucarnsvserroieaio.zamgwo.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200003998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.0fsirhh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200003999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.cmkqku.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.dzmeui.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.eudyfc0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.iqvrzg.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.tlqzfl.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.tp9ufdn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vflcpnz.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.vhvaed.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeiseaseccsrcoroi.visavucarnsvserrrieaio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.1dhskdt.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ayczzs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.dpovcb.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.dzxvjl.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.hxr0gop.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.jsboug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.nlxlcrg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.sgakhql.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.u8b21na.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vmiutt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.xjwvxks.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacerceroi.visacucarnsvserrooeiraio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.67ets1t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.6hqstri.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.bcowma1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.cdteph.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.devvza.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ek6va0y.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.fvxazeg.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.gisyli.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kaldkzh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.ohhclj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.orlkpu.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.segeva.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.tuyfdv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.0dkul2k.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.0fsirhh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.aakapv.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.aprjql.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.befcgi.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ekyhckm.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ezwvtt.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.fqcxro.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.gkvkwmv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.gmaphld.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hehbty1.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.hjcbmcu.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ijamkm.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.kqamky.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ktcwwov.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.p2pfwd4.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.ppsbcf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.qrvshpr.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.sfhjtf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.tdyoar.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieeaecseacercevoi.viiasucarnsvscrroreaio.whtllp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.aoadwx.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.gikdch.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.hdyn4ul.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.i9jfvsc.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kpv6yhp.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.kubvkj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.lpmefip.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.onjfanv.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.plmioax.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.sfhghim.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.vsqafmp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.ynlo5if.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieevecseacsrcevoi.viiasuvarnsvscrrsreaio.zbvjke.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.3r2oxoq.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.acojek2.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ektixe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.hmppcy.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ntk466j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.ojissf0.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.rn0xdmv.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacercevoi.viiacucarnsvscrrooerraio.zwvk70j.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.a59wwgh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.agltfj.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.bytirnb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.cvtbit.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.kcbnudb.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.pnl01rh.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.x1y65xf.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200004098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avsrcbdrpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avsybwetzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avtlkqdtgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avtouragan.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avwxqhvivu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avyofunquh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avzwwrivgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awbiaeooxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awdibhasui9.uidas.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awesome-leaders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awflvfhtfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awhcfavoxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awibhqywyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awkqqqd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awlubxvttu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awlxdmkolb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awqvuqcibx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awtsvcnnqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awvpawxssy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awvpnnwmwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awwbbziraw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axaesdfzgd5afy8p.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axawqghlxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axbvurppyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axeielneflnity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axhuhouvrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axia-land.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-infinity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-land-page.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfiinity.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinily.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity-bak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity.simt.ind.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity.wtf"; content:"Host"; http_header; classtype:attempted-recon; sid:200004132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfiuity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinftinite.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200004134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axienfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axienft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axiinninfinityp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axjalnfinjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlonhbhnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlujnflnjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlulnflnlty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axmphlosmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axmsqsvrvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axnyiheyvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axphnjraxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axqlijflgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axrlakdzja.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axssjsnhna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axvtkerunw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axwsbomipd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axzatyajju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axzhaquwxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aybdqqchpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aychikputr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayfoxjegni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayhjknkfwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayicalfbln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aykffodbga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aynkcsqnrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayoeyyixwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aysenurbozdogan.av.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aystkoqobb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aysvle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayudainmediata.portal09.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayutandrealove.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayvaxbjbys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayyrotsfyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ayzmelubxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azcmvv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azertyuiopqsdfgh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azizi-developments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azk2e-kaaaa-aaaad-qdwwa-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azkqywknmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azmaktqlpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aznalmaradesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azojduoacp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azrofnkvll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azswekpith.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aztfcqdaml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aztgfrsgeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-110716005.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-mint-connect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azukiofficial.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azure-microsoft-grupcollege.jelastic.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azvsmvumpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azzlawfirm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azzuiojcju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b.avisos-bcp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b0512850b11759fcd43bec4524ade9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b2bxenz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b56fb6104447f5e98c4db97696ee.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b56fb6104447f5e98c4db97696ee.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baanofamericase8.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baby-swap.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"babzcu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.b2bxmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bahif9042.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk36637.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk48573.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk84276.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bacpayee.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200004205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bacredomatic.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"badaso-staging.uatech.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeia42vdgnitrtosnquq2pbioi3j52pvtvnckq7jeascth6dbv7btwm.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiakig6tz6xg3ow4pdeybrxpawz62gk4nahpy36b7fs3zfsw6mdc7a.ipfs.w3s.link#info@example.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibt5y2f5aw44yhultavzdo4kzjljuu2nv7omhgkss5gldbkiv6g4q.ipfs.4everland.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicl2gbdmty7qbuweqcgg655ppncy2u7nh2ep22lcogooqwwn74pea.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicq7pxufv33qqk6kqumt2tsokvpsmpaaomq37shunx5zgrfrerj24.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeida33rhrdrttgvi22vzrxk6kqvhzqhk3w4dv254yyschmqsrgty2a.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiewxcgvmer7lbetii3yaujoxe5rtsdzqknc67hhxbzapgbpepkbgi.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigsrdrvuhr7kaajoxaynuihvyhp2bk2ywmvyxqxembg64ohmbmrcq.ipfs.cf-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigxp52gfpcia7p2oybzxjikongdp4an3aqobf4ijlv3c4irtktpyi.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihri5ltu2iimoyp65bigf7extwncyge56nytvhnz54b6bnbqctthe.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baguvixwpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahar.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahgrwimxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bahiacubanpizza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baigllbyfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baikuder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bairryyaww.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baitvnyxcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bak-1inch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bakhai.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bakiyo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baknfitzhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baktrvoakb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baleariclifestyle.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200004231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banacionetmes003.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banbifemprsas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banc0naciona1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banca-electronica1.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.fannysigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancatlantida.bancoatlantida1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancnacion4l.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-colombia-co.banecolo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-industial00.bancoindustria2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-industrial000000.bancoindustria1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-macro-onlines.ibsimportadora.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banco-ripley-ingreso-persona.letsplayfpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancobogotadc.3412244.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodavivienda.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodebogota.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodel.pacifico1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancodobrasil.ethicspoint.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancofalabella.pe.jorgemoyano.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogalicia-home.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogalicia.galiciasban.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogalicia01.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancoindustrialsd.bienlineacs.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancolombiaeravistuala.sucusalvirtual.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancolombiapersonasonline0.98937l3f39eio.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional01.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional040.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional796.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional907.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancor-gala.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancornetworkhome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancosneomc.itaumcneonm.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banditcoil.augeprint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banes-homeweb.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banese-llbank.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banhjarrro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bank.amilbank.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banki0wa.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200004269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankid-login.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankid-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankinghtmhome.bankinghtmhome.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banklng-cvvbank.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankmelenium.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankofamerica-live-online04a.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bankofamericaverify2022.secureverify.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banlombiamdwmnedfrrv.agtmedipt.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bannacion4l1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bannerbank.control-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banonline989.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banquepopulaire.wizardly-mccarthy.199-247-13-220.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banrural-ricoh1656622538.zendesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banrural4653.zendesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bansfield.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200004284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baohanhtulanh.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bapesclannft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bapipeijfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baprbpzicw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baradua.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200004289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"barraespaci.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bartiestbvt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bartsmarine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basedcryptos.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basketbackup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basti-32omna.zealatahimtre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bastitigeneasypakke-bd321f.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basudaratravels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bathandfloor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"batidospichincha.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"battlebikefitness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bauhrgmlgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bauvqxlmyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavmdfpzmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavrjhbcwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bawqpcsvwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bawvzhoxsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bawzqyrprq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baxfahntjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baxgbpmrzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baxxiffvrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bayclive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bazyjwpiqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbccb.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbexdfvq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200004316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbjorrbpkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbkano.mystoreden.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbkveorcjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bblpijynwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmaconline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmeziruym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmszmqmva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbogcnryez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbpr0vlncla2.bbprovlncla2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbpwtwihbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbqtvktbmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbsoaohixe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbtmvespxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbtwgdshoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbwgntlaxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbwykkdfnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcarcorretores.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcdc1cde.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcdytshjyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcfhwyiknt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcgfkfkazn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bci-sharedfile-oh.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcivzbhttr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcmgzwtjlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcnfciyowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcnscscrde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcp-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcr8j4js4am4v8pt.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcrdqtusxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcsaiifczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcsibutqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcxqywybsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdc-canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdcsvr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdescon12empresas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdfqzpvljn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdgfuiqngt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdhobrzorz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdhrhjmgfsvm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdiwqcsfwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdkgfjtqip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdmlilqqhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdozqoroyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdpfptagiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdphttxfnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdsfvytdeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdxxkyqtwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdyenvbwha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdzxxgzlvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-ing-site.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-itsme-db4bc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be-itsme-db4bc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be4yji.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beaelxwuaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bearfriends.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beastmode.co.il"; content:"Host"; http_header; classtype:attempted-recon; sid:200004372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautiful-goodall.171-22-30-134.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautylablaser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bebemoss.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bedcandy242.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bedjdneszh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bedressoo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beependra.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200004379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beer.loglet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beer.migrall.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beesaussiestingless.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beeva.sixcreative.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"begin.submit.q94j.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beho.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200004385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"behvrckbtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bei.nein93.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beibiku.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beingmelinda.organicmelinda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bejgldaxuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bejkfenzbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bekairos.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200004392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belgiumbusinessonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth30.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth31.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouthemailupgradeverificat.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouths-site12.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouths-site25.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouths-site29.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belpfwapfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belsouth.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belxvnxzgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bemzcwpaig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendigo-id-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendigo-id-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendigo-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendigo.limited-account.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beneficiosenoctubrebcperson.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beneficiotuyapay.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beoryhiqeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bephbgevzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beqzavtkvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berbeglia.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200004413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berguvbwhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"berryblossoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"besingularity.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestadealsmalls.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestchenge.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestcryptochange24.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestistanbul.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"besuqrsknu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beta-exodes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beta-exodus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betamedia.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200004424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betasegura-viabcp.movil-sms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betcbr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betrogs.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"better.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200004428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bevel-pineapple-pan.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bewgmtjuvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bewshdzvoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bewtyumxfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bex-webmail-8105040.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bexwebmailupdate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beyondcryptofx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beyywcghmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beztcyalns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfcdygkxnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdv.73951.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfebbqbvzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfepyqccgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfhhherwed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfjvrpoxoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfkfcnsrbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfkwdqfmoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bflmgkltxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfonakljnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfonjqrceg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfqfbjhjso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfqfzlxiao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfrajaruck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfthiivumm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bftuddkzsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfyyfulzwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgbeuhlkvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgedszujsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgeqgxxrge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgfqpwznaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgghgoggsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgielectrical.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgiwpuiywj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgixshitfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgluczwtwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgmslymtrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgp6nd.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgqztpguwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgqzuarnky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgtdmldtli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgtkkzvpoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bguyzuvmtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgxdlpwwdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgxwsvsuiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgybrthbph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgyxgjkprp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgzdhteqao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhairavstotra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bharatasolusindo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bharathi1809.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bharatmediaworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhavin0077.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhbuoeadin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhdrhnkgko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhdsgdej.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhebachspn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhgshfbiqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhhtxqogfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhigqvdtfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhkrbspgez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhlqtysgja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhrgnbvrtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhrgtbgrfegvv.degvrever.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhsmceldo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhthkqidgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhutbpwfsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhzylzajue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bi-enlinea.eu5.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biancce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biblia247.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biblioteca.sicrediprogresso.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bicicentroslezama.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bid-synergyfacilityservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bidlyiwjem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bidproposalforoctober.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienlinea.09765a.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenidogracias.validacionen.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenueespace.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"big3ownershiip.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigbarz.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200004508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bighatmonkey.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigshortbets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigwamhiax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biidjvicec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bill-rebate-gov.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bill-rebate-gov.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bill-rebate-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bill-rebate-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billinformation.connect-xfinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing-netlflex-logim.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200004519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing-status-check.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billing-status-check.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billowing-king-3b55.westernbot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billowing-king-b316.cabrag7764019.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bills-rebate-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billymilly.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bin-mo-bd1c23.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200004526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binance-1inch.listviewss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binance-airdrop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binancecs.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200004529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binanmainzeal.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binecne.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binthishalil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bionlineapp.eu5.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bipohaqkmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bipttcirze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"birdge-abrirtum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"birgitkoerner.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bisendive.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200004538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bisentechzone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bishopindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biswap-staking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biswaptrade.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitbaink.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-store.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinactivetrading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinsucels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfloat.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitflyer.fund"; content:"Host"; http_header; classtype:attempted-recon; sid:200004548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bithunnb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub-app.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub-m.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.digitalhub.co.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200004552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.otc.autos"; content:"Host"; http_header; classtype:attempted-recon; sid:200004554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.uk.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200004555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkuib.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitly.lc"; content:"Host"; http_header; classtype:attempted-recon; sid:200004557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitmart-trust.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpiecrypto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpieex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitte.modimyk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-moon-9725.regaccounts1009466.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-poetry-5215.westofsdfdsfd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-queen-2945.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-sunset-daaa.lamseem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-surf-a18b.tyost.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bittrend.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200004567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bituvxtmaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biuhrkdkmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bivdlmwkpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bivjkgqwsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bivuodktba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biyeybvlwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bizzapp.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bizzzzz.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjbqruappi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjdbsdmetc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjdtxttlys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjffgsgaqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjhxzezbbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjiiascfgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjiorkaxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjlbcisjth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjmkwuuoov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjoerk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjpmzydgqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjqabzzpkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjqhrjjmwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjrjgkhpzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjsfageeuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjsystems.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200004591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjtuynfxja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjxncdraak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjzlybveen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjzpwryild.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bk-muff-co-jp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bk-mufg-jp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bk-mufg-jp.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200004598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bk-mufj-jp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkbxhjbvgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkcoyqkcer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkdipoxqcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkfcmxdocz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkgaetphsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkgzdgcawl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkhucmrgip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkilbohymo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bknepwwjty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bknnsgbliq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkpuodwnqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkrftmqbxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bksameuakg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bksyrgricu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkvhsnevjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bkxgztphar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blablacar.id7345.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blablacar.ru-9394.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-bonus-a22b.greensandersss.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-disk-6500.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-mode-e8ed-office365.claretteemerald6712.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blagnxzozb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blcqmkjfli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bleezarun-authbaqtyus.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200004623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blerecovery.22web.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blizart.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blizzardlogin-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bljwsiavov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blkeqnxulx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blkrktrczp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blldghhvxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bloccadispositivoconto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bloccadispositivolugano.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bloccooperazionemps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"block-chain-connect.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"block-chain-connect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-sync.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-verify.softixs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchain-wallets.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchainconnect.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchains-recovery.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blockchainwebcheck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.brandmandir.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.porta-nuova.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200004643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blopet.avl-developer.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200004644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blpsahumgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blpyhzycrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blqcgffmon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blqzsspcxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bltmkjaftw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bltzjekpzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blue8z.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blutsvnnth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blwfpyrmdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blxpjaabsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blzfoqnuhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blzghtesrcl.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200004656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmayogqlmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmcnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmegroups.bme4718.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmhougjzoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmoharris.spencerooi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmpsmmejpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmqjhjywvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmulhutnib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmviqrkhyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmvkxukjdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmvrucdzwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmwassfxwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmxwejemgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmzhzkgvpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmzqafsikb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bn01928712.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bn1v903ejr405-gbvhn0-ewhngbv0-hnewr50-nhgb5r.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnacrinform.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnacrsalogin0333.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnb-pancake.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnb66.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnblever.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnbusdt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200004679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncas72376332.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncbncrs2.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncbncrs2123.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncnar.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnconacional.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncontacto00982.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncr-livers61.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncre.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncrna.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncrsecuryt.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnculan.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncvaejfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnfrvdasij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnhfvfxcsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnjwhdiqsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnklaeliod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnkonlinegalicia.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl-sistema-pubblico-consulentisociale.misecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl-web.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnl19-filiale13.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnmbxbtngn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnnacionaluer.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnnacionane.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnnc.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnpnote004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnpnote004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnrcsecunacio.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnsblmrlel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnswor.hwwag.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bntts.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnxinctopk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boa.flooss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"board.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boat-mature.dvrlists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatekantokente.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatqfsuzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boayfuawyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bobssigns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boc-update.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boc-update.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bodumtryfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boetebzojt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bofa-service.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bofwtjvtxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bogged-finance.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bogged.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200004725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bohomasks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bohxvqnezf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boiicyjedk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bojrkxkcgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bokgjqqbbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-cray.5-255-104-136.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-flower-99ee.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-haze-7962.irismiko.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-lake-3a7f.pojeecay.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold.wvo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boldd.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bombcripto-game-cv.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bommtfzsra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bomujah.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200004739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bonolle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boomla.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boostbyq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boqpiglpvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boredapeyachtclub.special-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boredapeyachtclubs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"borma.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bosbosleon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botecodomanolo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botnvuwfrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boumdremebre.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boumdremebre.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bountysday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boursoramaaccès.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bouxmlnicy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bouyea.esangbadkonika.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bovuqnpazx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bowedintentionalcgi.replit0912.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxdrop.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxypty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bozntihpoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bp.31-42-177-226.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpa2022.bancainternetp.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpanaqzjne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpaszcpitt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpcsscjfzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpcwuqxjax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpdgttgfgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper-ita.31-42-177-226.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper.45-134-174-4.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bper24.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperaccessoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbanca.31-42-177-226.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbanca.financialintelligences.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaclienti.apmcinternational.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaclienti.ghapan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaportale.influence-graphique.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancasicurezza.mainly-music.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancaweb.daddygoldenhome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bperbancawebaccesso.orientassets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpezyxpijo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpfhsidsny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpgzjwcjnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpkxojdnwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bplservicescenter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpmljmipwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote0010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote0010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpnote006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpojokydzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpr24.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprfonte.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprhelp.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprini.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bprmoduloweb.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bptisbrzli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bptrtejmsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bptvqajfyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpwsbyxngd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpxkozxwzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpymrppsks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpyvz.cytion.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpzgrmggul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bpzinnyzbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bq-trk.qw5c.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqaxjtykub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqbbzynhdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqbroxiwqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqcabwhqui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqdradbmss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqfrmnauis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqhqpblune.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqkolswhkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqlukecevn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqmkjwoknl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqnzdswufc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqrjodjuvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqrsjbgbdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqsarnijax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqsvxuurtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqtqgoqcdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bquakxiyzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bquoueggjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqvbnajyqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bqvwedpbxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradescoempresas.bankto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradescosaudeempresariall.sousanogueira.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandsforlessegypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandsoutlet.qa"; content:"Host"; http_header; classtype:attempted-recon; sid:200004830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brasreaincu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brave-gelatinous-puffin.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brayfobauk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bredft.start.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bredoytehs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brf-sadia-perdix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bridal.atshop.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bridgeyardcompany.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200004838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bright.ai4z.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightonukdata.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightwisecleaning.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"briketstroj.hr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"britishgrubhub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"britosracoes.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"briuznsfjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brjtv.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brlnet.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brmaoipwwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brmeendwue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broad-cherry-f932.mlynn1461.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brockhouse.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200004851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brohgsebroysh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broke.bibirpergikedanaubuatan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broken-forest-7f7c.westernrollled.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broken-rice-20d6.richardmayworm252638.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks--canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-forrunning.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-move.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-ooke.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-runfarther.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsbdyugd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdaodab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdauofc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks1914.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksforsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksghost13sale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookshome.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookslaufschuhe.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksmajor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewmethod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksonlinekaufen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksoutletonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksoutletstore.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200004875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksprime.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunningcanada.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200004877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunninges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunningshoesusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunshoeshopping.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssale.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssalemalaysia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoeau.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesfactoryoutlets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesmalaysiaoutlet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesstore.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200004886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshoesuksale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksshopsft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssko-norge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssneakerssale.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200004890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssoft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssverige.com.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200004892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brouruhomewebonline.brousqueem.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brroooksssale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brtyad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bruceslufthadas0291.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bruralcleangtwashing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brusher.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200004898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brvbcgyevx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brvbijvedo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bryoqaqqqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bs2www2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bscbox.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bscworld.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsdfdfasdaf213.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bselomyxzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsevmdwift.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsewhukzoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsgbdzthtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsgdckctcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsgmuyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsgoqypctg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bskmoevmwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsnelevkic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsnshlp.sprtacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bspdxwewxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bspywjhaqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bstxydqmsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsuhiebabi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bswap-finance.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsxvzxwrkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsysbvcxzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsysyiuyfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsyyfhqnpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-100895.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-101058.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-101857.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-102541.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-102989.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-103478.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-105397.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-108418.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-109500.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-109772.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-1454503182.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-1454584903182.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-allin1.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-connect-01d033.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-connect-44fac8.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-email-login-105063.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-login-108034.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-mail-resett.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-sattyuujwq.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-tillmonth.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-uduybdywiq63.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-update-101182.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-update-108264.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-webmalerrreue.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt.my-style.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btappsecurebusiness.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbbqocgmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbillexplainer.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbroadbanhomepag-106260.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbtgvbmgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessbilling.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinesscommunication.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessreadybill.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btc5667.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btc5668.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcminingone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcommunication.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-08f71d.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-091159.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-0d2e93.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-109798.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-355ca2.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-3a9d8d.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-59bf84.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-5b7b2e.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-5e7f8e.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-78a548.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-9e6c53.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-9e9e28.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-b40c03.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-c2329c.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-e7d9bd.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-eb091c.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnectbusiness-58e912.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcprofite.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcrus.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcx2.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200004981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bteampete.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btgckiyrtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bthqwoidrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btibuisness.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btibusniess.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-100376.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternetsyncupd9.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btiuytqadjfe9387uwesjzxjcfxsxz.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btjwjbseox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btjzzpvxky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlkjhkhhg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlyrgh.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200004993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btncxqwudi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btnecdmzye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btnypwxaoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btojoiqkud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btriqmgrjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btrxhbevmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btsei.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btsevermail.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btskisvetr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btstcbxlhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttsbyrsvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btttqjzomq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bttvmiecfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btufnrinim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btukpmbezt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btupbvqcmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btvcowbqaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btviewbill-584bd9.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btyeqarumu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btzfevqeks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btzopfcszp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btzxkdhivy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buaizonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buayyifbuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bubimbaicc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buczndoqgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buelvvaybs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bugdashein.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bugiohxele.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buhssgwshi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"builderscenter.co.tz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buildershoa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buildone.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bukidnonmockpolls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullback.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bullettrainbtn5.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bulpiwvxzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bumiehgxsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bund-de.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buralenergiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"burgess-sharedrive-0utlook-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"burtukcjua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bus968921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busainess-fb-129600825.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busainess-fb-129600825.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busanopen.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busin841687446874.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busin841687446874.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busines1912876921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busines1912876921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busines1928697252.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busines1928697252.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businesapp-bt.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-bt1.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-appeal-129687192.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-appeal-12986921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-appeal-12986921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-appeal-12986990422.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-appeal-12986990422.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-reivew-10968921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-reivew-10968921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-012869184.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-12099682.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-12198691.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-128571892.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-19267189.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-19267189.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-192869502.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-fb-review-192869502.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-help-center-016746891.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-meta-page-1096812662.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-meta-page-129865912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-258912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-00-519792.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-10-028591.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-052125.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-052125.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-085091.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-12-085091.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-120606252.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-128-96189.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-128-96189.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-129-06200.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-appeal-129-06200.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-meta-19286130.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-meta-19286147.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-meta-19286165.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-meta-19286165.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-meta-19286187.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-186715.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-197-62.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-218752.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-page-violation-9218-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business-wireless-att.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business01872961.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business01872961.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business112869128.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business12096879.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business1289768912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business1289768912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business128976912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business1298671982.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business1298671982.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business132876912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business132876912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business187368912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business187368912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business198276891.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business26567center64896.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business48412784.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business548489484.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business6487484.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business737392094recoverypage.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business7u1967violationrecovery.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business9810238431.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"business9810238431.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessbrazilmail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessfreedomspeakingacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessloansoptions.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"businessmanagementaccount.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busjpktezs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busvtilskm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"butyvansoldskool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buudaprbau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buxsvxjgzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buzacdyqri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buzaoujtir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buzdzxlche.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buzoyfkryp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvajdhhfnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvdcat.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvdcat.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvdrxvmwfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvfgazbzvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvg-101106.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bviklpedvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvkwepnxfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvlpjgmbid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvmjiogesr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvnhpghsst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvopwlrczu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvwexibkej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvzmmsqqns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvzyvhbfci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-informationen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-infos.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-kundeninfo.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-sms.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw-storno.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bw8zgq.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwayrlowjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwbffvsvhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwbtnnxpgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwhnxxrukr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwhriqekyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwjyfmrrzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwktjsbhdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwkykzlizh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwobudtlgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwsicherheit.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwstornierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwufroloea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwuoizjyiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwypkdyxxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwysbsgjqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwysmywjbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxbjlplrfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxbveitdjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxcajyquhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxgqxsmctg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxirupxmvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxjxmxlgfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxkomrqdjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxmlvnqerh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxngregdlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxpbdzjwts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxpjwnfgee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxsogefskh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxvraftebl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxvygxaqwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxwccqvklw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxxwlseoik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxzfptcgyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bxzvpittru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byapwtlnny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bycrfgfzpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byczyoeqan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byhlqkyzve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byigopzwpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bylanslhmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byopillsnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bypfodpies.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byringenieros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bytefx.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bythecontainer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bytheorchard.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byualhfphz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byvqtjqvef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byxhcqxmhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byxrlcdfxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byyxeqnkhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byzxtnskin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzay-rbb7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzaykbc9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzayrbb9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzeebtswkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzfoalwnsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzj908.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzjcdnqmdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzkccctbuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzlbkffspz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzlppgjmrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzoicysyse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzrbnapblt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzseycgtyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzyeffmgwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzygrrfyfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bzzzhbvxzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.curiousmorty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200005245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.gibsonwine.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.loveawaits.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200005247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1392047.ferozo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1471222.ferozo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1christine.tjelmeland2e.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c20f0789f73545650ebf57fa7dddc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c20f0789f73545650ebf57fa7dddc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2dcw069.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2hch255.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c3abh425.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c6ebv708.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c7d8fcc775c13766835eb0481e1c9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c7d8fcc775c13766835eb0481e1c9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c8ect236.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c8fot200.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca-aide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ca65t4498313.sitebuilder.name.tools"; content:"Host"; http_header; classtype:attempted-recon; sid:200005263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caaefxyhuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cace828.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cacfnd.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200005266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cache.nebula.phx3.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cadzbwacmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cafdigitdatawork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cagfpuiulf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caheuzaowk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisse.epargne.authentification.espaceweb.keindustria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caissedepargnesacur.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caissedepargnesacur.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-cab8a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-cab8a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-error.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-error.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-fd099.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caisseing-fd099.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caitalia-cert.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caitrionaflynn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixa.loghub.bhxs.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixainfos.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaregularize.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaseguradora.quadientcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caizbnbkud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajaarequipa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajabanrural.negocio.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajarequipaserv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajasocialportalserver.cajasociall.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajmpiura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cakes36.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calable.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calgaryren234tlistwca.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"californiaprincipal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-bakum.mchkkbny.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-bird.media-personal.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-lab-e74a.cattaleya76.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calplhrdir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calstateedu.securevdr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calvaryepiscopalbatavia.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camaxtesmails.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camaxtesmails.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camhencshf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camineri.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camiseta-verde.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camlrwlfwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campaapromo-octubre.noustecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campingdelacourt.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campsbayviews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"campus.hbchost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camtetszzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canadavisitisrael.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cancelamentobradescopix.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200005317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"candyrobber.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cangkulang.dnset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"capactmicroftmas.dns.army"; content:"Host"; http_header; classtype:attempted-recon; sid:200005320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caphvphcwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"capitallinkservices.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"captchads.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caqkpuixym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caqvmcfhcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caracasmateriais.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cardanostake.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carecentermtservice-7a94f5.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-52038.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-52038.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-cccb0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careerbuilder-dc3f1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"careful-aquatic-piranha.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caresure.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carjefzzft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carjiuhayq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlitomse.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlitomse.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlos.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carpediemxp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrement-bon.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200005341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrinho-produt09811.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carrorosabreas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carry-shelter.dvrlists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cartes-ameli-vitales.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas-polygon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2323233.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2323233767.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas2328743.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casadoborracheiroxx.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casanaturalle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case.96656282262.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002361316.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002361316.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10002616111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100036443676721.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100036443676721.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1000423621661.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1000423621661.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10005415641518.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10005415641518.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1001052105105205510.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100105610851085.adsreview.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10032250013210.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10034583495348534.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10035669164364098.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10035669164364098.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004108523018521085.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004108523018521085.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004300386.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1004300386.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100509562012098556.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100509562012098556.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100510541265100.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520132122612.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005205125784523.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100520651321652.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100542102310523.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10054293300856.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100543765456.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100543765456.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100562025202654.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100562025202654.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056216532150.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10056216532150.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005643859565.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005643859565.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100568941963205230.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005820652056586.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1005820652056586.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100631263152005656.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065203210662.ad-restricted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1006526525866.ad-restricted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065624458904.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10065624458904.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10069158710489.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1006930152010523.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100695265418023.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1007531059465852.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1007531059465852.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100854208521562.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1008552185632252.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009486532852.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009486532852.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10095258410510.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10095258410510.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100960653245132532.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100960653245132532.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10096205896274152.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10096205896274152.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085201851020.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085201851020.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085634120.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100962085634120.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10096301563206532.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009630563226530653.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009630563226530653.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10096315230542156.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10096315230542156.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10098410451087101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10098410451087101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100984156514650.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009841851085.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case1009841851085.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case100985104563265356.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10502036121.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case10502036121.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case984932423.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case984932423.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp1000437865789607.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casehelp1000437865789607.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid.10034557656786723.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid.1003475634890534.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid.100348573459346456.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid4785055283customerservice.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid7891000-appeal-form.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid7891000-appeal-form.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid923874238921.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid923874238921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casemetahelpsupport.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casemetahelpsupport.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casobrou1111.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casomicrosoftco7.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"castagna.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"castard.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casvzlrzbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cateringfoodanddrinksupplies777.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cattlesland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catus.cat"; content:"Host"; http_header; classtype:attempted-recon; sid:200005450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"causelesshappiness.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cavabienalley.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cavemannft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cawrokurte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caxita.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caxkuzlcfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caycos.beispielseite-wmka.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cayxdstvav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbcltamwuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbdufegimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbesgsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbgfneprgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbhou91px.fiswebdv.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbksfxc.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cblmvburjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbmrvnjuhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbnejbpbkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbnwefvbyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cboqccdvff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbplnifdud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbqcmuuwgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbrvhjfkld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbsbsldkwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbscdfvhog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbskateshoop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbwhgubqfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbwvchdcgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbxcqetjm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbxptodikx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbyywraenp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbzrdracog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccarse4.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccavbipysz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccbwfjtvop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cccnzsqnci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccgalicia.ccgalicia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccjrlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cclmfkwjza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccmwdxfhsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccoiiscoyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccriwzswhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cctqmrwczh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccvchgxzcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccwsqrxoyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccwzclvwci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdecornella.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdemp.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdggmziuou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdgywlkini.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdhbasnqan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdhk9i.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdlnjttvgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdlvfwocxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdn-32965.airbnb-onelogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdnajxqnxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdnjqlenzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdoywfuibz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdpdgaqwpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdryxrhuwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdsqwwftwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdvcmqbuda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdvdctntbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdwmizvprz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdzjarrkop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceccinmyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cef8vwt7y9h.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cejumzbkpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cekih9.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"celukpvhuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"celyhvbrxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cemzpogbvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"center-1-bd58cb.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"center-2-bcdff1.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"center-5-bcdff1.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"center-bcdff1.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"centrica.comaccounts-xaebufaknpqohyux8o1dhzg8.8222223808000023238222221103.figlandfood.com#ywnjb3vudhnay2vudhjpy2euy29t"; content:"Host"; http_header; classtype:attempted-recon; sid:200005526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceomyovgqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cepadhbudr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceptize.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cereupbkld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cersomps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cersomps.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificadosgobmx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificate.20-117-185-214.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certify.czauth10.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceshex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ceslsptyvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cestovno-trcanje.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cetfqmycko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cetpneoumd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cetsbfvzul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cexfiakfvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cexiqbjkbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cexxfinanicials.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cffdh.nnxzyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfgkgudxjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfjdjauobt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfkknzruqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfkltymeab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfkqxupaxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cflaxii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cflkcwszau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfogh.nttion.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfqqkkcspc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfraternidad.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfrdzalrrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfsfmnzmiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfvsyajrrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cg39009.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cg51043.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cg81734.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgagvvaxeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgaozhavjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgchfaqpkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgdokydoep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cghcuyugfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cghndcxcgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgmkdwuova.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgnkqmcpoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgnnvzlgqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgnshwglsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgqxamgman.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgruzbwtqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgrywuwgka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgtiuzvssp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgvrncpxev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgwgvqhzkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgwyvxfqao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgxgoettwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgymqotqdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cgywoikvza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-328328328832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-483828832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-connect-casasoft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch.savemysquashplantsfromborers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch938.brizy.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chacarahellou.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainfloki.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainofchanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainportals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainrunners-fremint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainswap-ecomi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainwallet.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chalkerabeat.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"challenge-eg.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"championsnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chancey.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"charbensan20293333.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"charlottejunkowalsh.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase.secure.emailonlinenotification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chaseaccessupdateinfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chchsiwsss-site.thinkific.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checker-1041734450.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849630.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-30000000025693459865849638.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-40000025631526895621365987.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685630.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685633.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-6000000006589746325685636.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-fb-80000000365948596325936974.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-perbaikan-akun-fb11.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkpoint-verifikasi.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheerfulbeneficialbuttons.davivienda250.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cheese.serveuser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chein.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200005644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chelanzzwa.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cherrr12.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chfkenirwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chfppzmvto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chicagotrolleyservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiclefrique.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chicoelectric.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiddingstonenursery.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chikkuthomas.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"china-gear.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinmayavidyalayarspuram.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiquititosmodainfantil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiragrajoria.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chisatonikki.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chitraprakashan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha16.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha17.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkcaptcha8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chkredirects.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chmcovjkpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chois.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200005666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chpngzoqsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chrgivkdoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"christmasraave.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"christophebarre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"christopherenlow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chs-configration-mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chswkmwkgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"churchofjesushchrist.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chutlincrapo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chwbhnxuhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chyang.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci00714.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci04572.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciawjkonzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cibibuoqdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cibjvosadi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cicatkwwxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cihocrvldq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciivzsnzom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cijfhhgdja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cikzpoatfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronlineiadesistemi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cintasejatidrink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciongxipoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciqqqzcpuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirious.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirxkwntbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisiqhbguz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisrznlecr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisteodpady.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citdalornm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citi-b39ca.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citi-b39ca.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiezesecure.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citionline-aouth86c0.query357.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizensbankonline-8454f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citulje-pomeni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"city-of-jazz.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citymobarachiba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciudadanoseguro.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ciya2022.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjdlasfkfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjhumwpres.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjidtafeyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjkgtsqcfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjlmofwqez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjmjociuch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjmyrtnpau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjnjvxtwib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjpgxmcoja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjuqsawbiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjveilxnrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjvqgmdjwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjwjpyhkyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjyqyxnssq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cjztmyzkcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckbdbwcwjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckbqcsqogk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckhevzwtho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckinucnuzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckjjpfbscv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckkfztkvit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckkvzqzfut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cklfznwdra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckojv.vailice.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckoqotyqau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckqiblrcna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cksthqfgjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cktlomcdrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckumsrlanc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckxoxdbfpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckyfvipmmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckysvfffzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ckztwbfwgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.gforce689.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.17f6e.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.5zy0my1.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.q74u0dn.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.amanded.ui0rb.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.llgca.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.oetnh.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.r3k0u.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.refund.vu65m1t.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.tax.service.6evd0t2.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clannish-field.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clapslide.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200005756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claridgemfl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claspogrix.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"classicstation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claus.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clbcxeppej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clbejowrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clblink.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cldzctcboa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clean-plastic-drink.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clear-error-activation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleargalaxy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clepper.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200005768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhnxegifp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhrbiltty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhuvpxgct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clhxqxqwis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"click-americafirst.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"click-here.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200005774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"click-id-bb1eae.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clickery.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200005776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clicklo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clicksite2022.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-particulier.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-servicessupport003.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-servicessupport004idsrvics.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cliente-digitalapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cliente.exclusivobra.appcompleto.dynv6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clienteperfil.bradapp.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clients.devtux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientsrvicesrequstdelivryusp-servicessusid3012.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cliffordchnllp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clineroaltoque.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200005788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clinicadatrindade.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clinicadelcomputador.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clinicadolago.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clinquant-entremet-59f5cf.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clkyuulneq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clnbifyjfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clockurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clone-7473c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-based-preview.shared-fileees.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-based-shared.line-assets.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-documents.member-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-preview-doc.zip-sneidjer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-preview-shared.auth-sahidoc.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-private-project.progrest-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-project-august.media-love.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-project-folder.files-progress.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-shared-folder.preg-remit.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-shared-preview.pre-signen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-storage.files-recruitments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-ways-document.confidednt-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.onlineapp.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200005811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.rodemsys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud102.hostgator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clouddoc-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudmachinesnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clover.gabia.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clrmtaifbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clselqokks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clsworkk.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1432536.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1448359.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1488541.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"club.idea-world.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clubeamigosdopedrosegundo.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cluqdnzxzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clwrwvxlru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxgqvpkht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxkwjbflv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxluhbbvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clxyxedqex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cm65931.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmacjsullana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmbmtisppe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmcxjtxneh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmdcdvagtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmfgaucfac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmggnmpm-69031.docauthshareportal.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmhlfzlpdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmjyeyrscw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmkplyzaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmkraxugog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmljwtleec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmpopghunb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmuzslpdtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn4e-69e69.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn4e-69e69.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn6v4b.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnbpyatsgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cndgjb7.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cndzfpzwnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnemacvojc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cner283829.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnfrmacn.hprusak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cngjjhkpbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnhtsthtvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnjmxgnaqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnkbzdmqms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnmfzsfbrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnmolwxeou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnqehjjqdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnqphhligp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnszgufkhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnvaxxjpqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cny-shopee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnyrpdaxji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnzgfqlisq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co-bccd2c.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200005867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co02814.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coc-blog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coda.prmm.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200005870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"codegodigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"codepasta.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"codewritertusharb.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coeenbasevalltextn-sion.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cofrhjhbum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cohsvcvapa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin-multi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin98n.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin98n.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbase.download-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbaseftx-wallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbazer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbsc.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinmarketscope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinpayu-adres.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinreauthenticatesync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coins-pay.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinsolutionportal.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200005888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinssolutionrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cokerconsultancy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colcentralnew.procesardatos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cold-boat-ddaa.lovinef1664990.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cold.loseair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colegiorealamadonervo.edu.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200005894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colis-bpost-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colis-bpost-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colislaposte.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"collab-land.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colobor.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colorth.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coloursource.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comercioinnovacion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comerica-rfy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comerica-rfy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comickarma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commbank-secure-helps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"community.avianarp.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"complementosicop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comprind.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compute-cloud.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"computer-4all.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunicazioneclienti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunicazionerestrizione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunitydtatermservice2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"con2dapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"concernedexemplarymatter.85755.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conexaonautica.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conf.chuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confident-hugle.62-210-168-162.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200005921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"config-accessref.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"configura-portale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"configurazionecarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirm-apps.yijang-invoice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirm-login-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirm-login-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirm-your-identity.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmaatendimento.dynv6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmacion.confirmacionm.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmaciondecuenta-c30e.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmaciones899.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmation-servicesusps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confitas.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200005934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confrim-account-pages.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confuse.onedumb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"congchungchuyennghiep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.bulgarianescorts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.getpaiddaily123.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.jsrapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.kartaldasatilik.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.lei-instyle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.lumiere-h.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.oraclevideoshub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.seitensprungaera.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.topalusta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.toptoy786.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.wallpapersboom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.willworkforprofit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.wisheswallpaper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connecct-login.womansworlmag.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-au-login.updateee.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200005952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.calidadtech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.chipper-chips.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.ciociariaoggi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.dragoneygaming.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.ellistrator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.fuelprobes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.gamerspride.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.hamidfalahati.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.haulagevehicle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.ideadigitalwsi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.kdarisalon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.lgmsecurity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.luisvaldelomar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.lvrealestateteam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.malakatogel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.mantasyisland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.margaretreilly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.more4life2day.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.pawstothewall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.procalldialer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.pumpituplive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.riscatoolhire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.rs485pneumatic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.sillygirlranch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.totsukafumiaki.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.yourtennispal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.yukiyamagirl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-login.zurichotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect.drivez.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectify.darknethub.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectodapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectwalletvalidator.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200005984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connetdapp.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200005985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connexion-sfr.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connt-w-t.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connt-w-t.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consegnacarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consent.clarosgvas.mobicare.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"considerpublisher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"console-ca1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"console-ca8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"console-ca8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"construction-document.kit-ouath.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"constructoramyc.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consul-bk-pres.nobreskateboards.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.inicioclientes.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.lineacliente.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.miconsultapersona.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.personalconsulta.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultas.serviciopersonas.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consulte-fatura-magazine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consulte.a-2via-online-hoje.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conta-sstonee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contabilidaderabello.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contact-noreply003-my-cheetah-website-1.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contact021.hopto.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contatti-mps1.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"continentalproducts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contractextension-migrate.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200006011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contratacionesmadelpa.234123.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contrataes.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"controlloallert.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"convalidanumero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"convex-advance.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-queen-7743.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-sound-a021.xisavok1422993.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-sun-00a2.wessternroade.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-unit-8dd6.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coolcatsnft.wl-premint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copxhxjmsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal182741.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal182741.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal213914784.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appeal2893179371.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-appela8913637891381.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter1289037189.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter1289037189.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter23178920.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter561679314.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal103874.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal103874.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal18937.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal192038.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal29302.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal29381.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal381801.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal395416.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal428491.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal801347.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal83394.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal837103.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal839173.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal896193.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal91773.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal91773.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal93177.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal93177.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-support-appeal94013.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter7562813.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-supportcenter8731639.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"core.pdf-asset.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corelinkswed0003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corelinkswed0003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corelinkswed0005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corklewmel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctionconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctioonnfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctoo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-2-bc9a64.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-5-bcae9e.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-bcea5d.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-es.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-es.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-express.35-153-52-247.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200006066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correos-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coruscating-cendol-924a93.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costaricaprueba.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costaricaretireonss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costumer-au-2-ba3b9c.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"costumer-care-2799d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cotgxpulby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cottonwooddentalg.nimbusweb.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coumiuryls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"countonfaith.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"courtcase.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200006078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coussco-web.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cowqcjqsfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coxeqduydp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp-group.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200006082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp.digitalprocurements.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp10.machighway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpamgouv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel.authenticate0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel10wh.bkk1.cloud.z.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpceivwccg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpcontacts.arshypermedia.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpdsgrufvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphamembers.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200006091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphewcrfkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpisafety.che.buet.ac.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpjjctzpfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpltdlsthf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpqkpxmvuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpsshghgsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cptj6008.odns.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cptpvbgpmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpumrsxvmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpxqihqdtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpzumnpzxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpzwadwqrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cq26646.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqaibnvjuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqdzpmlylf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqfesjzqaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqjhiudmvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqmngwxsvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqoropxcnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqpkinacnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqpvfvewfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqqnrmfeka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqrnpddwvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqsiuwronl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqsjksbenk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqtuydlohb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqwfafzigm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqyrexyncn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cr97154.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cramizytzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crazy-taxi.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbozuotsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbvksajoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbzgvugfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crbzlqjdbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crdcvbjksp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crddixsspd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crditagricolecaissgionl.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crditagricolecaissgionl.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crdojmnjvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crealitys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credifinanciera.didacsis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credit-agricoie.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200006135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200006137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole.djenanenoor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditiperhabbogratissicuro100.blogspot.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200006141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditsuisse.bluproducts.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200006142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credlt-agrlcile.contactclientbpp7.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credpdf.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creiomdino.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crematoriolitoralsp.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creme-crypto.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200006147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crgbybnwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crhxdetuth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cricketwlreless.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cricutcomregister.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-dawn-bc08.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-lake-8869.wastereno.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-snowflake-5a43.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-thunder-1799.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimson-truth-b81b.jefferyscatering1615.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crimsonquietcron.onlinert.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crjhutpupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crlmjuehyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm-galicia.snet.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200006160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.rlzinqhftp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmlgpmguj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmobepqny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crmvivhmtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crnmdxpiht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cromexa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crookedfatencion-usuario.usua7br.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crossoverbrazil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crosstheages-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crownsys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crqdndsztf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crqwdsblcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crranptpcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crrqcsjass.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crvepmlquu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crvjmtnfoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crwauzxyfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crypto-trustpads.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoassetrecovery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptobullnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocannacllub.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocar.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocarspro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocloudminers.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptolegends.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200006186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptomining-experts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptonvest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoplanes.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csaibznnlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csdfsdgsdgsd.sdfcsdsfsd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cse-syneoshealth.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cseeoiqplz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csegpqwxyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csfbssfuot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.com.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200006196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cskplxmhyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csmoney.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnforaccounts1000522151.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnforaccounts1000522151.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccount100045812.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccount100045812.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts100001899111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts100001999111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts1000400022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts100040022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts1002504511.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts1002504511.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnidaccounts100500251.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csnsrbdver.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cspjfodqrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csuxnayube.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csytiyzgli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cszffamaof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ct99722.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctatejsmef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctdvgvqphx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctfajxzlcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctfltizstb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctgbyowgnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctjquyqnbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctkopcnrop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctllcwfxta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctmredirapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctmredirapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctprqesiuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctqrtnrxbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctsbfvrmfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctszhvzrwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctttqdqulu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctubujygar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctufqjuexj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctuuwtgxta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cu14119.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cu80016.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuadrosasociados.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuaqwcfzxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuasfhwhjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubbychase5k10k.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cube-me.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200006241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubture.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuccoozmsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cucspibbzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuhaclxcnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuinojlfiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuiwiyarmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cukumlqsmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"culinfy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cunamutualconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupomax.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupoplus.beneficios.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupuetvpgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuqvdatilg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-field-bd79.wareareto.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-fog-aa13.breadgold8885649.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currently-103721.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currently-att-108139.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlyartt-102690.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlyatt.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlyattengine.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlymail-109438.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curtismscaparrotti03.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200006263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curve--fi.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curve-fi-excbange-viveiroentreflores.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curveconnect-v1.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curvefi-api.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curvegoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curver-fi-connect.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-admi-acces.autoescuela-aguilera.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200006270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customersupportteam.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuwpfqqdes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuxhbmdigz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuxwikgbyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuybitr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuzjseemkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cv40239.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvblniuiho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvezrsqmkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvfgcxtops.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvgsafrwsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvis.edu.sa"; content:"Host"; http_header; classtype:attempted-recon; sid:200006284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvixnofnxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvjrytsple.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvnmpnlaol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvolvzcrdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvqazungfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvrkuribd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvtsybumxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvudvpomgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvumwrqtnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvvdeegdrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cw02466.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwailygllh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwar9.enviodecontrato.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200006297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwdrwdxmus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwfmecgvox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwhdlwcdwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwiidurhst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwluriojtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwmmpdixxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwmtjfpnjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwoejrkmac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwpnpsujoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwrlgeuobp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwvjxfbsbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwykwwpiri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cx-mooeny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxagqppilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxaugmrwln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxchpavpba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxdgfewyhthg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxfqimmntz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxjysjzmty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxklphspty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxlgnimfjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxltquksqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxnavcidvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxobxxpoyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxodkdxjeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxrhiktqtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxsikhqknt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxsxcxtuyachsxcx.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxvfd.pax3tpu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxvncarer.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxzvuhfagi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cya.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyberlegalconsulting.banitau.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cybgexfzyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cybrrcwcqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyclcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cydwbs.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyhpxvqpmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyjjqtsnau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cykttuqrce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cykvlpstkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyljhzuaah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cynvdiznim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyoadksbls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyrkneezde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyrookauhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyubsooxut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cyxkkjwafq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czacdmdnkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czauxgrllg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cze43.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czefxuewpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czervygaud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czfxtqbxyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czgjcacmyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cziocmmadw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czjurbayrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czkanfbdsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czkyyztnbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czmapoabxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czmetporxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cznxyfvuvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czrvzhtxvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czugczjwdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czvkcsrlmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czvon.4fan.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czxpiqkmsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czypvxpuzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d-k-b-30-09-2022.from-nc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.app01988.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.edgecryptobf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.jxted.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.oftde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d2f71.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d4303943-31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d4303943-31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d4vipl4t4.recuplerarclav.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daacpkmeee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daafevevjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daapsbridge.fabulousseats.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200006379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dabsyjtsbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dabxphqmqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dacarlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dacetnroj-gemes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadafafwqqfwwg.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadaotravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadatcxzfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadmjdpgeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dafguypchk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daftile.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200006389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dagacam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daifiijdjfsdfeporwe.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daiichi-gakki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200006392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daiixlloph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daijeudfna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dailyclaimnows.run.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200006395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dainikjeevan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dalsekfelj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-brook-ef1f.wm9t6yeu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-cell-b538.walkingvibe0036866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-dawn-51e1.nicholasa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-f43e.recovery-page-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daneves.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dangerousuniquefile.gfdgdfh.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dangol-v2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"danhwbqpls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"danismakine.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"danyal-pipelines.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dao-looksrare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapconnection.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapmtfxguu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.busta.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200006412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappai.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappbridgeprotocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappbuilder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappchain.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappchainsync.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappconnectpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapplinksync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-live.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-multichain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-reservetool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps.chainservernode.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps.hstn.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsconnection.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200006425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappshubconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappssynch.win"; content:"Host"; http_header; classtype:attempted-recon; sid:200006427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappswallet.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsync.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsynch.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsyncprotocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapptools.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200006432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapptoolsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappvalidator.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappwalletsvalidate.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dar.kupabaruak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"darbytmpaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dark-base-6f49.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"darrenhousing.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dashboard-profile.files-protectiion.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dashboardverlogen-bd321f.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dataaccess.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datacoresystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dataeducate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datdhthsfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"date-update-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"date.ludtic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datetrdnow.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datoqtcnsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datrindo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davip2022confirma.daviplata2022.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davipl4ta.c4mbioclav3.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplata-informa.informed.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviplata-online.daviplatasoluc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"davipltpersonas1.confirmacioens.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daviviendaclave.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawert675432.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawno.ciwumugiasda.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawq.wlyhxj477.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daxljyxbqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.contrato.srv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.facildepagar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dayqbgnwpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daytrading-wallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daytradingcoinwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbaageztgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbaefzzzgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbbatwpcxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbdbagyqvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbdjsuhapb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbenpquyia.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbfjtiscmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbfmrucaub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbgdykfygl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbhitnqtjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbhlohalgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dboeqbzmsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbookmuhbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbqfwjdoma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbqtjspuiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbrijtsrno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbrrwubfqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbrxyncmta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbs-ibanking.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbs-services.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbs.ibanking.investix.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbspvwqpew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbulpsbuxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbxgbltble.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbzuhszdrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcauaomnqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dccjmhtnqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dccrrvuiiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcdkkkikii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfibamwer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfkfvddga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfnwmtjue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcfvgbhnmmm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcgbdfhd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcgpavkkoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dchpfkgvir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcinft.website-freemint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcjbjcpzya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcjusfcgve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dckyagcjws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcmtqdkhrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcnqrryrac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcnquxuckd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcnweamvfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcoxehbjpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcoxjiqata.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcqjgsfabw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcqszvcuum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcrqotmaed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dctitan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcuqoozadv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcyapsfutu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dczlsulwhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dczlwtybve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd1b31ee8fa4b8d16cf300f4e8222e.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd1b31ee8fa4b8d16cf300f4e8222e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd90001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddavncrdfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddawendgna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddbd350e.buffetnord.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200006525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddenekudzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddex.capital"; content:"Host"; http_header; classtype:attempted-recon; sid:200006527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddff-107235.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddfrszvbqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddietmhqom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddiouyyhcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddiveqzumg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddjqsqllhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddkzscohvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddnayjboff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddodwereth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddozejyatn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddpsgickyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddrv.broncotime.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200006539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddwkqafctd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddwlwgjlei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ddzxeocqlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"de-bank.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"de22c9kukppr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deactivate-applepaytakarek.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200006545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dearestloudtelephones.stormesall.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deborahholland.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"debugbyte.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentralizedcontractmigration.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200006549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentranodeprotocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentraqames.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentrskal-games-on.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"declaracionbienes-inmuebles.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decodeinterior.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decrmqeiwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decrocheur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dedicatedapp.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"default-132423534.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200006558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defensajudicial.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200006560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200006561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200006562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-g.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-go.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200006564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-l.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-minningpool.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-v.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-w.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi.walletusdts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deficonnector.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defikingdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defilo.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiportals.handmadebyzak.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiprotocolsync.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiprotocolsync.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defisolutions.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defumxzxkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"degentoonzofficial.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"degerkromaj.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"degzcftcvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dein-portal-kunde.de-main.latitud.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deintiershop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dejpaad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dekgwkaixd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deknolifyu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deknplyhki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delbarriovalpo.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delezhen.mashalezhen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delgeqdgsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delhiescort69.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-bush-0904.rcvrypahsajk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-dawn-reganba.vb2jdb03.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlmanage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlmanage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlswitzerland.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-dhlswitzerland.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery-incoicedhl-jsh6813604.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery.attempt.failure.asherq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delivery.attempt.failure.saliscreation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliverydhl-invoice.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliverydhl-invoice.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deliveryurequestclientxservicessupporsps.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellabruna.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dellver7ollxpls.span-dostawkans3.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200006606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deluxify-ff527.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deluxify-ff527.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demasiadoloco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.bradescocontrol.vertitecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.cedcommerce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.giamso.com.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200006612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.neuanfangen-jetzt.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo2.cloudwp.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demobbingc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demovp.cruisesmekongriver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demtic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dentallabor-morgenstern.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dentisthouse.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deqfwmqvhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deqwrmrvky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dermrbtlyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dermwifeapproved.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desarrolloturisticopartidordelsol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"descargarageofempires.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"descobrindoaveracidade.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"descriptivegeneralstructure.rebaking403.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desifxabnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deskorganize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desplugado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deteduoqmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"detrack-deutchep-psost.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200006632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deutcher.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-adobe-viewer.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-bancoitau-seguridad.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-bancoitauvalidardatos.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-corporacionbionline.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-dappsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-hbvcffes.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-hgfcxele.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-homeitau-segura.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-homeseguridad-itau.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-industrialbionli.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-itau-homeseguridad.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-itau-seguridapy.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-itaupy.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-nadaj.orlenpaczka.ce5.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-pyitau.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-tauionli.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-validaritau-segura.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-www.orlenpaczka.ce5.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.layc.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.pagseguro.qisar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.tax-pol.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200006654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.technotackle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev3885.d12z6dko779xko.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev5924.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev7029.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev9448.d1clnipioz5myo.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devdauwkpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"developer-sendgridapp.azurefd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"development.aisecureme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"development.omefyi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devineair.smkcreations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devonian-satellites.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devyom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dewcfthxfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dewzhxaubw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexapptools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexconnect.support"; content:"Host"; http_header; classtype:attempted-recon; sid:200006670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexconnector.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexfixrestore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexitznqiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dexweb3esynode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deylwwmrld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfdhdgjsd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dffs-drsfer-ftreeryt.agilecrm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dffshcrbgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfgcfvkfxdjkf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghhgfghjmm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghjhgfmmm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfghjmmm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhjj.irg70nt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200006684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhlavhlok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfhuqsdlmqmsdhy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfjzzxasvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfkesprorl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmbkctoif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmixlomzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmubhtfdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfmxzmryda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfopfpdkax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfqgmndibr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfsefbqznx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfsinvagke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dftojc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dftuermnoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfuerbfejdhbe.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfvntxzwuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfzddeoodw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgadagadating.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgajiajoby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgbijvpsof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgcegpkyoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfh5344ggdf54er.mydopweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfoodsnet.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfytjeety.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dghlzuwfzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgisupmzyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgjlsnblss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgkgqkixik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgkrlgwcne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgksejdnfg.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dglocpumxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgrtxdzuvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgselkxpsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgsjimwdnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgthyrdthrds.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200006719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgu9g3a2kzqx2.cloudfront.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgvmdsqmnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgw.soundestlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgwomvowyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhamfwjkez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhammametta-cijantra.or.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200006725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhanushr24.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200006726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhcsnjqehd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dheeh.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200006728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhjaaxkmev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhl-event.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhnvuwctsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhobxrcoxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhogfjybqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhpozhhogc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhtarztwrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhuwesrunc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhwjsakqtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhwzvrbdlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhxnrijbjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhxtbedvvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diarioinfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dib-digitalkyc-customer-profilec83ada.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dicantrelend.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-2f18b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-7cbae.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-bf96b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-eda79.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dice-fa92b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"die-postch.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dieetpsovo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dienergia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dietadviceblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digi-byte.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digiboxtest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalhub.westrock.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digittmboile.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digittmboile.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dihvnjtscs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diiadxsxnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diiufdubnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dikkfagffs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diklat.lpem.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diksowe.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200006763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dikxjlyzzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dimiloc.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dimmnrr-culb.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dinamibancolom.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dinoschiibi.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diobejirlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dioseshahaputs.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dioxgdmskv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dipakgaming786.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dipartimentowebdispositivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dipdxwbntu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diqhibxwdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diqxfnxxjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direccion219191.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc-co-jp.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc-co-jp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc.co.jp.bjdrhc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"directnewszone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direitolcv.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direx.is-great.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dirgold.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dirscord-nitro-free.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disconut-blank.co-il.cardcrucible.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordgifts.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordindication.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discountedinsurance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discoverdhaslkcxfinity1.560f866578.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discovervisionary.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discoveryartesgraficas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200006792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discreaty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diskord.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200006794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disponibleahora.assitecac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disponibleaqui.transparency-tv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dispositivobper.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200006797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dispositivobpercard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"disrupto.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distinctdarkredsubversion.josaperes.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distinctivei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distribuidora5sentidos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"districtchronicles.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-haze-2415.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-mouse-da46.kontor5687.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-queen-8fb3.b4ahgnor.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divine-sunset.p16t2853.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divino.zxinomoiszer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divorcelawyers.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200006809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dixonind.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200006810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diydhbpmle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diyymaoozx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dizjutvkcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dizzvydpma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djanxnqaxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djbingproductions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djbsgjpkpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djc74bcd9b51a2-1ebf-4df7-bc61-d371fe9eccf.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djcjzxfzdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djdqdhnlmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djeuzadrdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfjbvcwdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfvjkvygu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djgicdhsxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djijdaninl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djjjhnkohd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djmebjrrjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djohhlyhdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djokjodoow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djpowurhdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djscordnltro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djtlgvkzsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djutqrehht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djvhdvsetk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djvymxmklu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djwtxrnrkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djylghwcvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dk6k0z.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkakvwgvpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkauyvuowp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-app-aktivieren-ba61e1.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200006841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-daten.act-or.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-kunden.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200006843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-online-banking.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-profil-update.ddns.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200006845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-profil-updates-online.ddns.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200006846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-profil-updates-online.serveuser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkhbaxpedt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkhvddzxqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkjhbqvrot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksilaban.helpprotections.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksitamjuntakk.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkkvjrkmoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dknbkzxlea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dknreeknze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dknsgulqsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkocsrbsdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkowbqggwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkpirvtjoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkqrxjrwkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkqzalrpzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dktcbiooal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkuwuvqorz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkwdrtdcjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.9xu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlchpjedva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlenspbecq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlgeabgant.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dllscourd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlmhvanubt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlnsmpjvsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlnwvfejqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlozihnlkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlqrnlihvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlrect-snnbc-co-jp.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlrect-snnbc-co-jp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlroezdxfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlscord-tm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlsqagnfhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dm2.opq.pa-tarutung.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200006880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmarket.se.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmcekatzsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmdecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmdvpibdhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmgfgnznwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmgshy.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200006886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmjrnyhvvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmkdzyuadp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmkudjwspe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmldiatmoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmlnpgjwdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmqlstqsql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmvhqjmefs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmwwsaquuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmyvqrovxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnbauth4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnbauth4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dncobidorf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnfkfftfsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnihuuwqkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnkazetqgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnkfiomahw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnnkxyrmmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnqnmlknvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnrebrfoss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dns8.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200006908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnss-3982f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnss-3982f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnvxbtbqpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnwvmsqact.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnwvpkuwii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"do-any-3.strangled.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doanmnmmmmbnmdffd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doc001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doccusend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docdrive01060authorizesharingfile.onmicrosoft365.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dockweilerconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs-dew-6406.retupamyte.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs.revv.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200006923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs.transactional.pandadoc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsreceived.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docu-auth0.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-cloud-secure.piltrimuging.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-clouds.fuconbaetu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-folder.chat-verify.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-private.direct-sustutelue.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-product.rototetiined.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-progress-asset.retupamyte.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project-june.voicee-love.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project.secure-count.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-projects.files-auuth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-shared-folder.date-oauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-shared.datings-prev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-update-progress.shared-filees.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.lates-proposale.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.storages-clouds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document2c-f4e80.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document2c-f4e80.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3b-d779b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3b-d779b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3e-e09ee.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document3e-e09ee.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4b-8063c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4b-8063c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4c-aabc6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document4c-aabc6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document5e-22051.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document5e-22051.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document6-23891.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document6-23891.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documentoprotetto.filedicondivisione-909524fb9aa348b230295a2b7a842c21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.projects-june.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.shared-authentiicated.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.uvzcknthvfffqjzakuxgdrnthu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusign-pdf.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusign.mslive.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200006962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusignredtail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dodnxipazm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doemcvyovm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dofus-touch-com.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200006966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokorbwjhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokosgiium.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200006968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolipops.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolunaytravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domaincontroller.pmeimg.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200006971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200006999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domesmarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donateb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donatec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donatee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerbe-06.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"donnerwebhom9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doodles.freemints.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dopinrlmvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorkoragnu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorotanowak.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotggmapeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotsatoshi.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200007046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doublequotes.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"douglassquarechiropractic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doumebremesere.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doumebremesere.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doumedremesere.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dovzdrpdxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dowaba-s2dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dowmbsyd.donhacarsyi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"download-folder-files.secure-place.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dowqqnvxko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpcpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd-shop.08452122.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.nogltox.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.paketversand.20-0-217-175.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd.survalyzer.swiss"; content:"Host"; http_header; classtype:attempted-recon; sid:200007061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpdmodwtnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpdxnrulbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpfko-inv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dphmxgksyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpjmqtwekq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpkrbfrxuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpm.usbypkp.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpmasdaskj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpmtfrczvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpncbxamrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpp-bridge.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpp-solution.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpprpqxabg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dppzdqikta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpqhcjnpkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dptointerno9021.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpumpbfffj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpumpdcbui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxaesgrmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxmubfncc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxromhxih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpxufnfuel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpzilpphnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpzorthwtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqbiqgngbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqdxdohikc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqhiavhjup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqhsnlnzpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqhwyzllct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqlzwjdgsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqoejjciof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dr0b0xonlineserve.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"draaggtfzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragarwaldentalclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dragonfish.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200007096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbazzpinx.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbike.co.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200007098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dreamherbs.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200007099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dremondrebese.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dremondrebese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drgjxphkbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drhrochow.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drittohub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive.dataexpertservices.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"driveequitypartners.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drjgpkzvya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drjiofficial.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drjule.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drleokeegan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drngarzcta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"droits.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drojjhwbpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dropbox.sudsafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dropboxbiz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drops-trustpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drover.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drroegkcln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drsridharspine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drsykfqvmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drvapp.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drvlfhgdff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-dawn-acf5.jgomez2482804.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drykmufvky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ds.tdj32v8.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsacjrtmmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsaefkiqmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsagjhcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsckyaqwfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dserqhjyih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsfcdn.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200007133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsfgasa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsgbcipitb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsgcbeonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dshgsgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dskuk.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsnppdsobg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsouhdmptq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsplxzarcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsqchejrgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsscwtl.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200007144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsvg.ctulrceo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dswtohrbml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dswzdcqbvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtb5ns.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtbprmogbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtgvwfisoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtjelgeedx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtkpdqqvax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtlieolgbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtlkzevhju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtnbroadband.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtnupgeuth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtrhvpexga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtvevrednv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtxmcynjkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtzriypcsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duahatii.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duaxmqblfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dubochazgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dufudgahds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duillykeic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dukrpzlslj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dulywxfolh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunbunteloal.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunescapital.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200007169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunmowlwsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunphlkefb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duo-ange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duofqgmcis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duoscene.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duqsxlfrlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"durkpuazvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dutgjxwtku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duugsrvxsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duvqpvjfxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duvwqormul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxarzkmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxhqghqvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duxwkyfqza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duybntzebw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duyeadswyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duyelykxxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dv.xzcxgnv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvassociates.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvavmhifka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvchmwaqzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvcollzmea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvcosglsnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvdxrsbyqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvenuaufjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvhgcbnepb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvhrvhdlbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvjstrvziw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvs.xgrunrk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvspjqpggh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvtznpmbho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvwctfsuif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dvwuxwwnxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwdf-107283.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwdhtskmaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwdowxqvpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwevqgaeyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwgnfwwdja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwluqochck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwmhziqgoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwnlpstdgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwnmdfykat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwoiyajmia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwpiwahzrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwqcccrhfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwqdoyaglt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwqtcdoiss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwrtulwewb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwtvlheppe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwtyoudbej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwxrhrsvpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwydlghpcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwyefdfxtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwzgxlkohy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwzjyjmnvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxbmuxveao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxcdobxvuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxdxdxe.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxertizpub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxffighjrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxglyvxone.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxgqldacey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxhgizrord.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxisdfkmkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxizmjiicu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxjdmqhpry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxjvoymhjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxkqczgdtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxlxtvmitj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxodxiyweh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxpgoaaxjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxphulsxxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxpvbgxmxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxrzdfjhzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxwanbcfpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxyjqggniy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dybstxjuzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dydcrpfkrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dydtaitxtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dydx.in.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyglkkusup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dygwpkgrvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyhyubbtol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyhyvdklcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyilgcvbkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyleeqbvvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyljactffh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dymddexpqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dynastyclinic.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200007260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyno-tool.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyoardhydi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dypepwkxto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dypfgdgjir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyusqunzyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyuvstyfawecteraw.blogspot.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyvumtvodz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzblvnzxoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzebachonm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzeexhqcub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzfywtzhxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzgonacnhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzgszyhzry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dziemmwjoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dziniaxmsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzlyqgkjtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dznjlcvdsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzppwlggpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzpslheasw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzsdgrwrye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzshmkvpji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzwgievria.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzwyohnwtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzwzhbcdgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dzzhycdwkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-access.att.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200007286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-cassare.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-mailterra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-mobilonline-basvurusu-com.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200007289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-pb-oauth2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-pb-oauth3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-pb-oauth5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-pb-oauth6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-sport.bti-if.dk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-surat.kominfo.tabalongkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e.gpro.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e043976a.kottedj.uz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e1aae61c265532e4bd8a014d5391cde4-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e4ra.byethost8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e63q45f9h5fr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e83e5ba2291017f22a7f2fe61c784339-dot-office-352115.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e840b.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaazpxsvjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eae5e.escolatantra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eagleeyeapparel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaglestar.com.myelf75irfhajtm3egepywelf75irfhajtm3egepywelf75irfhajtm3egepyw.servicecareireland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eagopvl3cv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaiotdzgkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eajbrqqggw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-ceuzw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eakl-nuena.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ealcdmqoje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ealgpoetxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaqurhfzfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"earn-pancakeswap.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200007315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easy-walt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easyweb-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easyweb-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"easywp-bccd1f.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaxcdgpjio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaxmkhahhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaxohhvqck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eba22248.nadiaschweizer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-a3ab0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-a3ab0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-f599f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanking-ch3-ubs-f599f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebanwxamnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebbekqfmbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebbwwmsivb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebfzulhqzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebhmyscadd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebijaopyeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebilciclch-s-site.thinkific.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebonynexus.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebstgzvwsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebvbuaitmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebztuqtulp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecaltatxpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecarbmomuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecarflzajp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecatyytsio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect-outlook-auth-0ffice365.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect-outlook-auth-0ffice365.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccoselect1-outlook-auth-0ffice365.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccvwticlifiagcfuters.sobre201.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecfumcvfzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"echwrtzmrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eclass.johnrobertpowers.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eclrwlglhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecmahlfgjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecnbjeshtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecnhbfzxrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"economic-poet-b50.notion.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecosystem-shiba.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecoverifymeta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecqxtjxghg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecstatic-yalow.212-192-246-28.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200007358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecuopzmach.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecwohphtna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecxayisboe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eczvhdbhek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ed1c0d.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edazeljtsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbrooks.graphics"; content:"Host"; http_header; classtype:attempted-recon; sid:200007365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbtzthimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edbwphfdgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eddedesigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edfujvnvje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edgecryptood.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edibleadvancedrelltrempo.ksjf8nsiiik.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edilgicostruzioni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edisonair-sharedfolder-0fficedocs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"editingthatworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edjpblpbos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edkovlxiae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edkzlophqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edments.edments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edmzmwjpda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edoammifit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edocuments18032022app-1310252903.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edok.unikama.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edrdykaypp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edrvereeix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edsgvnxjkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edsvapsamd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eduassignmentshelp.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"educaresatkhira.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edufarm.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200007389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eduintello.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edywfyteln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edzivulalr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edzqohelgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eecusite.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200007394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eedomdzcbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeehngtmwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eefchnjhac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eefmunraae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eegiqmhiab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eehinruxrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eeimnirdub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eejwpbkbnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eellele999.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eemxsayxfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eenzscxpan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eepscwduue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ees.co.rw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eetsumhafb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eetusfkzst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eewaaoavgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eewdvfpdww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eezxqlaync.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efad-sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efarkwhkvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efax25042022-webapps1-1311433986.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efcyczxecx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"effism.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efgsdsghn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efiekwojbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efijofnala.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efikyfgeul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efizweqtnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efkhcfwdxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efpllfwvey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efvhaeabzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egawjsfbhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egdhx88.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egegreherherhwefw.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eghnltovnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egjktjfruu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eglhtfqttm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egniol.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egnllfqtyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egnzgzftjh.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egnzgzftjh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egojvhkjef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egpexspbea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egqorlhvta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egvmgjwrcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egwgbuvnzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egwoexivza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egyptvespa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehckypcfxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehdnddlnxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehejtbzbvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehfbthnvst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehhzasstoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehighwaynews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehkjmfwcio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehlpdyikbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehmfmjnfxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehmolqrahg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehmtnfrqyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehporiinvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehsiuskema.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehuviimosf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehvhmcikjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehyqwncaoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehyrfculpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ehzijkmjlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eiatefmnsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eifkoufuso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eikdzudkud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eilbcvqtkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eilcchfwoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eipfwcyxey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eipkryzzgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eiqanbavey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eisen.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200007469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eivpamvbug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejahfzqlek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejeebkynam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejlhopqtyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejlkyxxymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejlweglzsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejolaxpigj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejqpedljqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejrlryxish.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejshelgfxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejuoezksix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ejvcxmeqke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ek1-nep.3utilities.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekaminsurance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekbrhsilpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekcyozdjsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekdibvejzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekhaan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekhehvyfwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net.com.kdjtcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net.com.steway.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekiminogpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekiohnners.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekjcinjvaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekkhmaymjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eklenssrnarw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eklrplsjbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekmxqswzef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekpjpdjkpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekrcneqwli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekrqtlcnud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eksqflufor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekuonqdenv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekwzidpeye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekxypwqunr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elaxbcsapw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elbendittoferxii.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elckrnzyhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ele-gota-feel-slf-bab340.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elebmksixh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"electricianslexingtonky.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"electrocoolhvacr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elegant-saha.109-71-253-24.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200007512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elegantamazingservicepack.onlinereq.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elektroonline.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elfatnianass.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elfinanciero.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elissaalvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elitedentalofsi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elixirsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elizabethhauler.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elladabkfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ellbxgufgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ellington5106.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elmec4you.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200007524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elomo.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200007525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eloroempresarial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elsewedy-td.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elslxtzulc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elsmzxenfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-hellenic-post.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-hellenic-post.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-pack.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-pack.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elta-post-hellenic.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eluhfdddir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elxlikxucj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elyjotbama.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-login-page-100040.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-login-page-103332.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email302.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emails%2eazure%2emicrosoft%2ecom@url917.vakeelavaahini.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emails-track.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200007542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailsettings.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationadminupgrade5.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate1.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate39.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate4.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate82.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate9.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailwebaccess.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"embkhhyzor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcconstructiondenver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcnifcwzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emconti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcpfsbyqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emcwyqdehl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emdmqwxohf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emememmde.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emerson-vertiv-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emerson-vertiv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emerson-vertiv.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emfzxgtyhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emhbaszacn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emhsrtzons.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eminengalicia.iniciositioweb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionebpcard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionebprcard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionecarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emissionepay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emlink.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emlotwvnmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmgdfenhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmxertvou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emnjighqzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emoncmlhtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emphasize.qhigh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-paper-6486.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-rice-4c1a.brian2495.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-river-9729.qm4e2oon.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emqcdyyvmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emqyrpiwoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emtapjyntn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emtlstexzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emunabg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emunufgnvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emxukmezpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emylzakhhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emzrxtuxzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.dappscentralfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.kprfn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.node-etherjs-flash-fix.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200007591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.techsmainapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.vivuni.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enabyrdayw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enbolivia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enchmcdhet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encqolrqjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptaiu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptbtck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptdrive.booogle.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encrypthkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptodapps.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encuesta-covid-octubure.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encurtador.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enebqbpmiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eneco.nl.verbuik-gas.teruggave2022.21510-4044.s2.webspace.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200007606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energoservice.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200007607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-bill-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-bill-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-discount-form.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-rebate-gov.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-rebate-gov.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energy-rebate-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energyshop-bitflyer.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eng-sharepointdocs.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engcamp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engidagraphics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enhyvvgqrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enitbkcyzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enjoyapartments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enlineabceperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enmodofeliz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enmutlutasarimlar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ennaodyzjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ennarqgowb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enoklkfduw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enoxmklxfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enpyfaewgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ensalfkyfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entbqnk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entbqnk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enthusiastic-quintessential-basilisk.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entreprisedeplomberie.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entretiensetup2014.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enutvdcggq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"env-9635017.cloud-fr1.unispace.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"env-resgatarfr4644740.node.cloudlets.zone"; content:"Host"; http_header; classtype:attempted-recon; sid:200007637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"env-resgatarfr9880498.rag-cloud-ch.hosteur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enxnqtbmru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enzmjdtfbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enztjtjljl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eocaoydycy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eodtqwdpnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eodvhljobz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoecifigsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoffice.bulungan.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eofinusdin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eogwdkwzjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eokimayid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eokirsesczwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eokisercuind.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eolrlbjmaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eomuafrbel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eonwyqhsga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoohfcssut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoqjcartcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoqsusjvey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eorlavvljd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoubdcpfyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eovotguvja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eowbtdyqsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eowlxxkeve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eowrszorva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoxpycjiuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eoynxxvsqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ep-2hv.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epdjttzgxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epetfzghkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epllhtemve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epmfqpleud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epndyuyqvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epolkszpul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epoxqzauzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epqjcyqtvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epurndpzjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epwiqiumvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epxdnmkaus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eq.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200007679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqdtzuvozh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqlghmlcoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqlj0053oonn.aerro.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200007682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqnaygisrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqnmcukioq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqrvvyzgqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqsnncygsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqsqqswqny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqsqvrepfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqtonsrthe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equalivet.org.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200007690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equalpleasantmonitor.aderlsk.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equipe-servicedhl.com.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqyllwtrgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqywmbthcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eqzrxyfwid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"er65g1051ftgf.myddns.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eranurirzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erc20-coin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erconxzajb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erdtyfh.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eresnuestroganador.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eresnuestroganadorr.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergambrummetre23.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergh.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergjuirsyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ergofnhitn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erhvxovsod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eriab.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erjhhntwtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erki-ceuasrci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erki-ceusnaci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erki-czuasreei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erki-czuasxci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erkwwznidd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erl.com.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erlgh34klhklfg.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200007716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erqxnbyxjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"error.de.in.ingreso.mibody.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200007718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ershamshad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erthjdsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ertrfbfosh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erty-108066.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erwzeehidx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erxvbsttau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esautodealer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esbbzuynoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"escueladeatenas.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esd-dbs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esdesbxahq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esdi.allelor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esdxjgakoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eseowmhoct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfdesentakip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfgsdhjggsdgsdg.sdfvsdgdgsdg.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esgwuugoeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eshnbppest.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eshyjrmejx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esig.co.kr"; content:"Host"; http_header; classtype:attempted-recon; sid:200007738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eski-cceueecwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eski-ceuscwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eski-ceusrud.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eski-ceusrurd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eski-ceusrurzd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esl-giveaway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esmeraldamurillo.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espace-vitale.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200007746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacepro.apnewsystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacevitale-ameli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacevocal-bcf21f.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espacioajeno.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esperanzabravo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essencecannabisdelivery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essential-tax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esso-extra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"essonjpjegfilamotepage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esstrovagancelmpdsolu.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200007756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esszoqb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"estado-personas.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200007758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"estrdmrljx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"estwbeieop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esvtzuzoxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esvwvfvusm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esykwtwnza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esywfnsriq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eszxvtufqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"et-magiic-soll-enter-eth-9.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etaqtedfux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etatrecharge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc.faded-co.jp-visdam.gurong-group.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etcciruyjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etdsolarengineering.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eteqtjpukp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etflapzmko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etgqbecxgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-1inch.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-metamesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-pos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200007777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-wintermute.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethadapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethautominer.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethbw.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethdw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ether2x.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200007783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum-18miningarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum2pool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereumv2-pos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etherorcsnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethers-airdrop.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethers-airdrops.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethersairdrops.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethhex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethhnixmtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethjq.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethjs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethju.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethlr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethme.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethnictrendz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eticlufbsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etikhgcx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etitimwmzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-wcasnust.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-wcasorenst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-wcasounst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-wcaswest.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-wcsucest.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-weescrsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-werscrsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-weruccst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etki-werzcrst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etlte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etmtmaavai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etpvigksig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etqhuvpvgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etqtrvylmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etrmmzpsmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etrvdrcphv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ets-afeesco.tg"; content:"Host"; http_header; classtype:attempted-recon; sid:200007820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etsdwdyuiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etuukryuxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etwtkrswes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eucieuhtxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eujkaaczxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukhjhvfhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-peascoey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-psacaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-rzeuaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-taseasvs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-tsecsza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eukl-tsecszu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eulcyprdgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eulxugspof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eunfhqmmzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurapgbqwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurdefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurobengal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurolatspluss.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200007840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euroquimica.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200007841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eusmxyzktt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"euujokorqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ev3db3.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evadeetvous.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evbbagdsfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evcxxbyatd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evdvvwzroz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eventchip2b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eventkoindomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evenwheatfibonacci.paraguayitau.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everai-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evercore-trade.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evereco.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everestmotors.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200007855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everscale-ecosystem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everyoilydrivers.hmtlsfsf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evggukannd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evioqmfqhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evjdymvifu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evjjveircs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evkfsyrjzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evmyrbjsdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolbithman.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolutionsny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evorkuxpsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evplugpower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evqugdnqqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-redelivery-failure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-track-id92.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-tracking-id384.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-uk-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evri-uk-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evrxnepyeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evwsulmvql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evydrmdjie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evziwxutwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewdljcbvrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewfcljuvnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewhzrmxrvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewnbyrenyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewoaylrmyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewpygyccdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewq2j4kgk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewqokyksfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewqsxdkokf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewrgguogyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewvvgefuyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewvzwtxraj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewxrjnuahu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewzkiuupdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewzsgqwvhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ewzvckprxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exavyyfixy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"excfzfwdbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exch-093data0303.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exch-093data0303.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exchange4free.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exclusivoestemes-ib.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exclusivoygarantizadobc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exdqmbnmuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exgaptnrbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exgaxovyjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exhpgmttqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exito-validation.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoapptuya.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoasesoresalcliente.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitopaytuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitotuyapayfmw.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoytuya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitsecutt.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exittopagosapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200007915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exkntciuvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exlzfnskwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exmocoin.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exmwpbruuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exngqqehum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exoasdus-walle.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodos-wallett.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.bond"; content:"Host"; http_header; classtype:attempted-recon; sid:200007923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.download-wallet.arcticasfalt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.adnansohail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.andreealazar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.androponsel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.hrtrainingme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.incrediblestrikers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.puskesmastabaatas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.taleemo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus.com.merge.unitednationsauthority.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodusweb-pro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exogamic-odor.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exosiuds-walle.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expediapartnercentral.solemarnoronha.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expertzigzagmemoryallocator.allhometok.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exploreaoe.com-rfq-specifications.smpn1cilegon.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200007938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expoglobal.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200007939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expohogarcix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-15323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-15323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-a749b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expressil-a749b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exquisite-treacle-9155f5.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exrjiqdhbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extensaodehojeoffiline.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrabrasilonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extracloud.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200007949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exuvimgjmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exygwifxwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eybaclaopz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyebeyasvda.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyeweb.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyewebsolution.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200007955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyfrjofcip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eygqutkmmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eygvgtyspv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyhc11.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyhgtwpwjjysh.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyhrwebdoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eykmwvedgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyoxebprgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyshbnzmia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eysrnypfea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyubdptdjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyvohszcch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyvxqintki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eywiycnyqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyxfmvwmyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezbbbqkrck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezblox.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezekcllub.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezfhuzemfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezgfmfofzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezjeanpctq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezjqcdkumw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezjshgetoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezki-seescaci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezkjaoorii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezluzxleas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eznfensnyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezrbubuhno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezsfeespvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezssausage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eztrgmzwcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezu-nft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezvsdkkasw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezxofbcere.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezyceslfyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezyvgzuloc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezzboiyejk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f-0465yh-jme4rt0-hjn-0etjmbh00-rjmnet0-hjmn-0jmnjm.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f0w3e498ifr0k-0fdlk-3rje4kf-gjkwre-jgv-wr09jv-9rejc.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f2pools.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200007995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f394f9i-02w4kfd0-w9ke0gfnjw-0rfjnmg-0rf-0ef.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f69e9.veritascare.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7543f8081ce47f6aae2d816d72cab12.jaguarverse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7760567e673.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7b8870cd2801tau.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f8put2prbcr1hfd.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-2022-log.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-accts.pages-recovery.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-aman-verifikasi-2022.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-10014887759101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-10014887759101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-1001745724578101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-1001745724578101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-20024145785202.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-20024145785202.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3003428746303.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3003428746303.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-3030194675263030.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-50054245178505.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-50054245178505.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-70074128541707.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help-70074128541707.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help200274586435202.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help200274586435202.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-help30305848756843030.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policy-helpcenter-form105.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter10.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter105.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter11.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter111.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter112.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter114.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter117.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter120.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter123.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter126.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter127.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter129.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter131.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter133.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter134.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter135.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter137.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter138.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter14.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter142.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter144.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter145.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter146.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter147.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter148.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter149.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter15.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter150.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter16.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter17.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter19.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter20.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter21.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter22.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter26.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter27.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter28.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter31.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter35.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter36.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter37.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter39.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter41.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter42.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter44.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter45.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter47.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter48.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter5.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter50.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter52.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter54.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter6.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter61.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter62.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter63.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter64.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter66.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter68.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter69.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter70.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter73.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter77.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter78.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter79.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter80.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter81.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter82.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter84.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter86.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter91.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter95.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter96.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter97.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policycenter98.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-redirect.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta125.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta14.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta20.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta248.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta252.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta266.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta270.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta320.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta349.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta352.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta361.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta369.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta378.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta381.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta385.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta386.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta397.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta403.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-verifyissue-meta64.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook.somfivestar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport35.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport38.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport40.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport41.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport44.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport45.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport47.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport69.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport70.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport75.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport76.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport83.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport88.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport90.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookreport91.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookverifikasi74.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebookwebloginwelcometofacebook.videlite.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200008135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faceit-arena5ee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facenboollogin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facenovi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fachuiadfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"factgrading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faezjtrzhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fafugoiftb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"failure-post-redelivery.myip.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faioomfmrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faithfamilyintl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faizankhan0408.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fajxmpotfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fala00001.falab000bella.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falconinternational.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200008149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faleballe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-brook-b2a0.althaf30.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-disk.1zofvddx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fallmouth.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falvk54lkhvfl.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200008154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"famosauto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy-rain-22bf.vakagew948.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy.bibirgadangdicipok.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancyexpeditions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fangyanbj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faniosewyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fantastic-code-5riyp.cloud.serverless.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fanvanllc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faqesslncf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faradaydesy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faroffwobblygenre.usdt56352.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faroltiweb.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faruq.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faslxddfsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fast.for-orders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastmigratevv2.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastrectifier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fattura-nr641.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fatura-cliente.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fatura.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200008174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturamendodebrinde.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturaxbrasil.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturinh4magaz1ne.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"favore.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax-doc25042022webfax-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07032022doc1-1310019602.cos.na-siliconvalley.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07042022fax498apps58-1310726006.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fazfuyskpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-appeal-form-de977.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-appeal-form-de977.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-case-id-28031803-fcdc-48af.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-344255.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-344255.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-5002214.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-community-standards-5002214.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-help-restrictioncase-f7ee1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-pages.proteksion-help.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-appeal-f1cb8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-appeal-f1cb8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-case-6a568.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-case-8da58.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-case-cd4ee.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-case-f26ae.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-case-f26ae.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-form-297b0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-form-44f5a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-restriction-form-44f5a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb7927.bget.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbaptmfsua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcaseid.100357347858345.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcfsihqfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcqrigdsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcrxnxgtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbcukgxsum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbdwbmsmxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbejmxfdrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbfwmwzgca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbitasngvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbnpgfetsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbnzocqnbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbookhelpsupport.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbookhelpsupport.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fboxctfsnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fboyihynmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbrfgfqymu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbtoiioxlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbuvbfhiml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbvccoxhvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbynsynrlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbyzetohmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fccfc.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fchxmqemwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcjfbpfmjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcjhjnfcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fckzjjumub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcmsoyfzwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcocnjsgbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcqeietygd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcqnosmscl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcraxvqymy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcvcujweaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcxesewcubexcy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fcxesewcubexcy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fddfgwtqkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdfgsbolar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdg56.onlinebg0.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdgwecsy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdhghjga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdikom.uinjkt.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdkfvxyowx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdlmcolpmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdnfjanmgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdnqdhpnul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdouuuwvhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdpqcedfjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdpzqzhpso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdrwfpgavu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscwyqhis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.zb4i4i.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fduiktszhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdwcplogtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdxdcsphad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdyahlrbmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fe8b1a89798e43ceb1b15a2a0d7e1193.kangarooverse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feaecmqruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feauuigrkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feavvaslze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"federales.validacionoficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fednmhcrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feelbons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feffixywbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefwkoaced.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fefypekafj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fegfiqzrwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fehvkewawm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feio.pietism.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felhabcxmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felicids.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felmfeklpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femqicvexp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femtibkrak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femzxqavka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fender.atsampoukos.middcreate.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feoxjdbaxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fepigvkdty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fererre.kabelis.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ferjuokala.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fervent-shamir.13-237-241-193.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"festivalesperu.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"festividadesperuanas.hogarseguro-com.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"festividadesperuanas.mxmointernetvelocidad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fetsvjavjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feupnsxeyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feveozkoxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ff-member-gerena-vn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ff.koh7.dr-abavisani.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200008290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffemeqlnuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffiwdobobm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fflqcfohrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffmdehhknj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffmugbrmcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffony59cuza7qa.och.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200008296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffptvhocib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffqwmneabf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffrancess-onlinne.pmotoo.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffyzoivpex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fg3erg0-f9w3r-jgf-0w3er9kfv09-ewnrtg-0ner-0g9jn0-rg.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgbjydtxtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgcdmgpchv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgenm-6qaaa-aaaad-qcurq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgfgfgfgfmmm.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fggf-105120.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghdskjhgjhkljg.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghjr74rhudfguhtfguji.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghwe803r4hfg0-whre-0fgvh-0whv-0wshjv-0jsd0vjh-0d.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghwere908.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgilolfkwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fglafhscuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fglomphntf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fglztvzjdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgnkn.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgnngffhdgd43.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgoypsnfgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgpfgxgaka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgpxpzhwul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgqbwpafzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fguvjeklvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgxikcoeau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgxjsuzoyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhdruvrrvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhfhtvxbsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhg.79176.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhjmkzyzqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhlgnzyfop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhmnylkvlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhniptrkkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhooqygjkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhtyorydff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhvyulysfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhwvqrzsjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhydhjwith.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhyfbjqhdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhyinjuiou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhzoynlxih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fi-neearwallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiauojzetn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fibpjzxgsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fidelitybank-ng.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiercebuffalo.build067.wpsandbox.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiercecannabis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fifththirdonline.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fifththirdonline.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fifzywhahy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fightagainstcriminal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fighting40s.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiidiunvbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filderhiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-annual-project.cesfulenter.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-cloud-download.remit-advance.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-connect-shared.loading-chats.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-login-micro-drive-doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-login-micro-drive-doc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-pdf-cloud.voicee-pre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-project-shared.init-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-device-storage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-secu-doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-secu-doc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-cloud.lepoyanecalt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-clouds.data-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file0z.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filedocument-updates.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files-secure-folder.ansimapreg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files-view.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.recloud-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fileupdate-docs.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fileyellowelite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale05-177-mps.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale11-operatore01.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale13-mps12.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filiale9-mps-189.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fill-form-41207.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"film.jaheshguilan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filutflugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fin-trustpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finalizarsolicitud.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200008385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financeguidelaunchpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financialaggravatingoutput.yoursegcity9875.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"find.verify-location.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findlak-investing.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findmi-sing.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200008390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findomestic01-filiale12.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fine-art-studio.hr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finulasante.lasanteactive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiqgscoxcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir-8da4d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir-8da4d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir41109.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fir41109.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fire.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firenaci0n4llogc.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firgisxpvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firmantai015stepms.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"first-class-agentur.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firstalert.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firstsourcesbus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fislozkezo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fittingaveragewamp.453453fefsf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiverrespana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixdappissues.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixed-alive-munchkin.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixi.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200008413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjaajgtskm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjbbyodxzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjbkvrjsxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjfhfnjvli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjhkjkuli.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjhpjqbpmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjjfjdf.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjjodramzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjknhfdpsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjkzhhyqof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjqfgfacgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjvhfqiwoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjxqucpfwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjynuopuru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjypnbtgad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjyqimbnvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkaoyrcyft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkaqevuuik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkaxcokjpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkhcbcocpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkioiseowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkldolqjfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fklfiivgpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkliywtazi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fklpnmqzzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkmnjsitsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkpcbthowx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkyzwemvoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fkzxkecgxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flaremcnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flashalotproductions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flat-9be3.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flavianovis.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flbuenrqez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flbwxzinak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flcancer39-px.rtrk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flddhcrzpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flddzeekiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fleetshop-file-0utl00k-storage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fleetshop-file-0utl00k-storage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flhjmdugpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flippantworrisomewearable.nini1102.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fllwbiybyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floral-glade-f27c.do050.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floranostra.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"florejackie.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floridaaluminumsystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flowserve-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flowstringsnode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flpitoyzlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flrcldfjqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flrhuoccvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flsinrrqmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fltgmulcjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flthkmbwox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flufmqxdrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluksrv.mycpanel.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200008470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluttergirl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyairprestige.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyfmthejz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyvfrontier.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmawwtirax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmcooculjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmctfkpdlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmdzxhityr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmeta-verse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmfqbxzhtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmiipvdbxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmiqdletnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmnfvmesrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmp.wordpressmlm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmrefyfuls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmseqmtiap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmtphyqypu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmtzslsdnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmuxbjzrhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmvswufbme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmwbecyegg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmwszwgnxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmywaxbqsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmztknxtcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnatichub.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fndwltpvkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnfnywfsxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnhxckuiha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnksnfaycu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnogfjsmdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnpsgjbbdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnuckrozvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnvogvtflq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnvoietjfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fnydgmgckk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"focunffsny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"focused-elbakyan.34-135-142-3.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foemqngqig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fogfbdkqkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fohssbxigc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fohtgquncv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fokxkbetec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-preview-project.privatee-inv.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-private-pdf.auth-gear.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-private-project.important-chat.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-shared-file.voice-chatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder.verify-files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fomaxsenxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fongxijwhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foodcarry.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foot.ludtic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foot.migrall.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"for-pages.caseid10375453.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foratech.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200008524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forextradingtruth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forgottenrunes-nft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"form.tax.s40h.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formacion.accesodigital.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formbuddy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formez-vous.eligibilite-web.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forms.formium.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forms.sendpulse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fornewsgroup.run.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200008534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortunate.waiguohuo.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fortus.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200008537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fosocnejaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fosterfulllegh.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fotonordlicht.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foucafjmeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foulrwdoru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fozogtortr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbglogovr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbleitidh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpbpmsflbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpcpawrbhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fphjccyhhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpinlcgtot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpjhbzpsvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpkzxdytvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpnzzxvdgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpumsflcbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpvarkwwim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpxgegencq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpxtindbvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqcxfasjdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqfcjwnccb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqfvstdmpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqguxxxkoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqhihopwpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqlrkapcdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqmvcievvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqoolrbldp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqpkwzluhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqpsetsfsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqrdpfrvzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fquxjuverm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqvrbchifl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqzgghjrnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fqziatvqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fr-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fr443.liv2454.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-dew-337b.orgetjot183.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-forest-bbd6.woolcodeddd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-grass-5770.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrantghgh.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frainofzuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frances-home.cosmeticlab.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frances.paulacaroli.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frankfurtertsparkasse.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frcjvcfolx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frcyjtondn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freelifeinsurancebook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freemint-cryptopunks.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freemint-invisiblefriends.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freemint-moonbirds.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeprocrack.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freesolana.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freesolanamining.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freetopdomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freezing-emerald-almandine.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freg-nine.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200008594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freim-regulation.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frerdvpisp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freshled.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freuz-pfeiarm-mccrur.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frhpwvohcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friendly-booth.5-206-224-168.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friendsofnechockey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friesssd0006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frkuejhfnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frlsevjxmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frlxqmhmwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frmiseajourdesinfosdesdecouverts.coordonnerlesvetements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frmwqoyznl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frmyoihoyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frogout.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frontier-airlinesreservations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-credit-9294.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frpgkicllh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frr603.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frsjfjuexh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frsjkbvadsayt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frthuzwkfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fruiting-offender.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frverifnotifs-b97681.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frvwmhlkks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frybuoobho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frzstdajcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsb1cn.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fscbubxiho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fschwuftxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsdpwmbsnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fseqyembbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsheuygtzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsjiefavdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fspciahkkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsportplays.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fssffsgeegeg.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fssfokudnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftamfgdgkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftcfbntaxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fteqbzwssd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftfaqdrkck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftfoxsbvfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftgmpyqfdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fti.unmerpas.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftlpdovnlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftlwzvkvic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftmkuqndjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftmpnixfws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftnixcwjyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftnulonpra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftoc.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftp.cnc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftrgdyhlhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftsixkwnpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftsrgvibtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fttutvuzyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftvflbbqop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftvkgganhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftvlckayof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftwgsxdinb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-ca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-pro-register.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register-pro.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200008658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200008660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200008661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200008662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx012.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx66.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200008664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx666888123ftxapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx7.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx7.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx77.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200008668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx8989.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxbonus.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxcoin.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxcprotocol.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxop.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftzmjttnvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftzqnyfrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuacascqvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fucciobrooklyn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuchsiasuddencryptocurrency.anuncio22.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fudssfcfdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fufaxh84js39fj2.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fufkvzqmpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fujqybuqxa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fujqybuqxa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fulbhwcqnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"full.mailboxs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fumanecdcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fundacionmontesinai.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200008688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fungoodpay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"funiswap.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200008690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"furlisnk.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"furryvengeancefve1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fustuhufyi.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuxnpyveqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuxpjkhozq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fuzhqisipf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvbvfcvumj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvdiwqmjmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fveysezmgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvnjkxfaor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvomvsqzte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvoplgujxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvuoeadluf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvwawmecko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvwropiogw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvxbnuxfoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvxdvgceyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwcpxcgucb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwgzcuqeoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwi3lkhd.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200008710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwkvbnyouy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwnndqpbsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwqbymlmat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwrscizlqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsgyndddq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwsvxlacsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwvaxsfzxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwwbwbuory.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwzldvqrgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx164fax08022022fax-1310019602.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx406543docs4580246-1309906520.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxewyfrkop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxfpwejmrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxhxeqjoqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxkeipjdza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxnyepbkwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxqbfvtkjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxtvkniaqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxvqiglifb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxxueoxwud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxybalktzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxziwuowej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyckxoipow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fydjiinfpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyetlozqsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyewdajtup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyhsxoelqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyhumavjzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyihhgtrqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyjsvz.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyndiqaq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200008742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyngezomie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fypokkcavb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyprxtnjun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyufnolkwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyunmdwwxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyuvcjgbco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyvvfbnmbt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyxhgpsvdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyybtirjrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyyiflddtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyzvziqhmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzabdjmwkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzcwhwlrbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzeadalwkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzekbhanad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzfnmnovye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzhcmfvdpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzhfqgdgds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzjirpixsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzjnzitozf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzkdlivenb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzklpmghdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzldmkbidm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzletzhczk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzlmucbklv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fznffgohza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fznzztuutb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzozmoucli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzpvagfqjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzsrjiybay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzuoliogzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzvifhkhbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzvnbbezbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzzvgieyeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzzzynzpoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g-mtcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g-tg68.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g348g0fh4-03whfg-0hwe-fcjn-w80hr4-08fghw8-efh.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g35g-0e43t9rkg-vrkwemmv-09ejnt-vmjne-rf90nbv-enjhtb90rfv.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g6beb-cqaaa-aaaad-qd2ma-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g8e5i-0gj-w0rhnjgv-0weht-0gjnws-r09fjv-0werj9f.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaawrnjdbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gabelpahog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gacrucrep5stlw.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200008786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaerjqtmgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gafjitibrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gafnzuaqnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gafonline.mil.gh"; content:"Host"; http_header; classtype:attempted-recon; sid:200008790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gahguvmzwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gajttydxgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gal1homc.alennfire19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gala-bakes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galeriacoachingmexico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galerieharmonia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galicia.moonrivery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciadfx.galiciadfx.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciahomebanking.gaiiciabaking.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciapersonal00993.tomasnuve11.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciaportal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciquebe.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gamarlmhns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game-defiknidgoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game.hicage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game.ludtic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gamerpay.com.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200008807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gamkoras.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ganhbnseyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaoftlngeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenaquafree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garmon.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200008812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garpwleqgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaskarten.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200008814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gastraew.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gastronomiaetua.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200008816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gathertexas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gatza-shibaswap.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaudfpgtrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gausnow.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200008820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gawayu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gawquntxke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gb-evri-package.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gb-evri-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbacgtsscy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbaxjppsar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbdpnyywza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbfzfpejmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbhdhrozzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbogruhckg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbonplqgjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbqfxlzamn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbsqkmocpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbuznqcvlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbvxctrgpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbwbilsogx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gc.elin.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200008837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdeqjdsxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdlvpvobd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcfravpvuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcgavczfxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcgfgmysct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcjgzngkfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gclskszlyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcnizwhwqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcourdefraind.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200008846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcphvmgbwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcqbuwvmqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcrdxrmktv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcsoozmxhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcxmmtwxnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcyialgdst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gczcpdsvcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gczdjlqulr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdabusiness.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200008855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gddazgsfql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gddxzpsovo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdelements.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gderuvhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdfwvvgbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdgaccyeph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdgoenkakapurthala.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdiilfowxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdmcvtbvhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdnokndjot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdpflztxrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdqqfncyes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdsdhfnbxv.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ge-jrg5-ekadf-wnr-gfmjsaw-0rgnmjv-wsrnjfgrfr.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geaoodyrrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geatqyzdsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gebsxdobrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geckorewards.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200008873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gedeerjkjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geegegegehhrrh.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gefdilxxmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geiq-btp45.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gejkxcruvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemcora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemini-00e.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geminimobimovel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemkgahxjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemxbipinz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gen2sharefiledocusign.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gen2sharefiledocusign.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gencybedmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gene-tiic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genehmigencorner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general.general-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general.generalauthmailbox.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general.timeoutauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general0493043.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generalaa-e69f4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generalaa-e69f4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generalmainnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generateethereum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genie-alba.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geniusinu.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genoco.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genopets-verify-connect.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200008900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gentl.bibirkumaumeletus.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gepco-jobs.pitc.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gepgmjiygt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geqbymjrxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geqdqqddwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenci-lss.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenciador-caixa-gov-login-th1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenciadorcaixass.pagedemo.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenciando-da-fatura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerizkuhqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerlanguages-serverde.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200008911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerrowstroud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gessoriodejaneiro.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestion-ameli-fr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionarcitadaviviendaenlinea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestione-operatore11-mps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionsigwebchile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get.freetopdomino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get.payment.begalcentil.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get.status.garong.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200008920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getapps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200008921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getartd.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getdrop.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getfremlbb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getkebpnxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getkudgbog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getlikesfree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geulsztdtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gevmara.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gezwurokmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfagvmatxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfaollfiqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfazsosiji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfbjglctwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfizncjxob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfjdgfgty.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfkhuueeeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfluzuywii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gflyrfdfic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfokcblncu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfspimgvei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfthc.surveysparrow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfufqalhph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfwwardrxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfwxqqixur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggdbhimywg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggdfdfd.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200008947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggffftfhhfft.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gggrtzbxyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gghjj.edvjayw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gghnqkevyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gglflfgvxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gglsafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggmoalktez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggmukbtldo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggnhcdklsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggqttlofsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggupvhhulv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggvvsymtek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggyceljtna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gh.vaayne.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbqpsoxxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghehoycgdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfaqgdvbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcv.owydwj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghgivwyakc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghhdweovew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghivwcmtfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghjtasgkhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghkishmzgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghl9uc.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghntywxonl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghorana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghozman.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghphjuwvrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghsbafhdtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghsyfscibz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghvjidysgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghwvsziybd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghxgvnheyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghylvdfifm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghyvpmikeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghzuge.vectorguitars.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giandlqrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gibmgsmcsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gicwllzqrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gifltdilscorb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gifted-black.151-80-79-188.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giftgarden.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200008989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giirnmmpjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gijgpary.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gikkvugbyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gikrgkctsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gilgyanarj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giltretysy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gilyyjaoeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ginsikzsvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gintonico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giolrgfmre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gireiwyebk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girls-tube.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200009001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girlsrideout.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gistwatchdog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gitep.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200009004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"github.leikaifeng.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gituecachm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giveupgear.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giwpqzuvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gixvfoncrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giydardbat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giyslfwapx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjbnvxgval.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjcnbxeyaxlrmycpwke-lzjgljgjmqapmtlgvnl-d-kqfyinxpoenwiouwal.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjhacfftfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjkgmrhvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjkrkqtyhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjljikqerr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjlzqeaixe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjnivfazld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjoulxanjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjozfebafp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjpghgseza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjqpvbgshf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjryijpuny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjuknklilb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjuvlzjchy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjwoclmbsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gjylcwfpya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkaxlepapv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkbcijdebp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkbdwaakyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkbjqfswme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkfarkdqoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkfqwlgxvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkhsruqwvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkndqjhace.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gknyiryxlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrghoofpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrnoomtpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkurzycepm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkydvbnqwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkzhoubgra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glakoleip.klayfort.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glaxhdzvil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbftxtgvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbohevsds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbxvyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glceudthja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glcpaukrwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gldcmedjfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gldektzigc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gleefulcultivatedflash.habilitar87.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glendaleazbeecontrol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glennrothenberg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glfnuagfwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gljaptfdjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloaezfoso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalmediahq.ultimatemusclegrowth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globaltrader.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200009059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globovidrosss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globus-fitness.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glogo.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloqsmipqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glpoakmnkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glrguaehgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gls-parcel-dk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glskjuiuib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glsword.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gltkiufwfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gltncaoebf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glvifqzjcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glvodzgbmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glyrmutxhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gm0-a0z0ra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmbauwjdpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmbxwlpfsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmdreeqaep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmeauppgwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmegugoqdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmephimvxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmfikoqodh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmfksqbvuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmfsvtmsze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmgbtxbpth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmgroupllc.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmkfsdinxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmlljascvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmnwozqcko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmo-aozera.bankn-japan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmrpxtrzmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmrxdzwltg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmsocrates.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtbzwztlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtkougjeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmtneiihfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmuavghhlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmx-deutschland-gmbh4.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmx-srvr.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmxlitt.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmyjdhzftv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmynet.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmzszfhgcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gn415v.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnform.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnnxvzquum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnosi-ssafe.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnosis-safe-io-app.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnosis-safe-io-app.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnosis-safe1-connect.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gntfnaviwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnugrujqpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnuvtzlhbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnybeapwem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnyddvpmik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gnyriusbzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go-staking-hex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go.hobbeaxasi.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200009117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200009118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go24link.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go963029741.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200009120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gobcnlezno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gobjarimua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goblinstown.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200009123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gobwlccdwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goddamn-scopes.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"godocusign-login.rackapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"godzxkongmc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goguiduiox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gohbvwsiil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gohxjgwvux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gokgarywyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldengold.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200009132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gollardtime.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"golpapbmlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gonauowmkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gonline-blznesplanet.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200009136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gonzaleztransformacion.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"good12345.tripod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"good245.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goodmine8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goods-vihted.8878871.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goods-vinted.4652254.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goods-vinted.7980904311.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goofy-robinson.171-22-30-134.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200009144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"googldatariskwarningg.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline-biznes.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline-blznes.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline.bookerlsat.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline.boostersmode.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200009149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goonline.sterlofsesd.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gooopfadof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gopaicerqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gorgerlite.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200009153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gosqyqzwxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goszjtekqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gotbglcvbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gotvthjzzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gouvetech.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gov-rebate.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gov-rebate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"govqpzalxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gowydmdawk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gozeco-pompe-a-chaleur.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200009163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gp101.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpcarautocenter-web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpceshgerk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpcvftptxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpdvnmpafk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpgkgdwexr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpjldpdvuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gplwlsjety.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpoqgppgie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gprkjfjwtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpslqanyjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpusuldgcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpvupnxnur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpwxlwaiol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqcfdtdppa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqdltbvvkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqdpbpknud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqeehusvqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqesgtghqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqgxdxrmzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqouuicjqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqpejlstxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqqqontsjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqrmkbudbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqrsioketl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqrvqrknfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqsicfexij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqtgbnprje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gquhpsxeoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqutfmrjfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gquzcrezlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqyyxdwkxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqzktwtchm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gqzllfosdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graceful-tulumba-255b79.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graduated-military.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gramaticafaturas.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grandswiftshipping.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grapeaccess.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graphic-boulder-301015.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grblgijadb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grdqddjviv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greadedu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"great.loglet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greatwallrak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green--dream--6331-on-fleek-co.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200009209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green-pine-7fe7.do020.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green-surf-5642.5pi4f9jl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenland.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenvonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenwayweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenwichtc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gregdondds.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grem-6yt7h.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grfogzpujd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grfrvypntg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grgupfbehv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gripxnagei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grlkbobqwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grorcjpjts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"groupe.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200009224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"groupe.societegenerale.keindustria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"groupesuseg.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grouptravellady.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"growthmatter.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grp020idraknten.43dx5b.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grp020idraknten.rgaltn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grpzwedshs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grraxazfjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grst.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grtayzhbvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grtoykmfgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grtyrtutrurtrtww.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grubba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grujqznjkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grup-wa-virall2022terbaru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grup-whatsapp-porno18.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupo-961.tp961.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupo-b4nc0lombia.home1749.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupo.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupodetrabajo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoelectorial.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoexito.felicidades.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoexitopaya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupomova.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoonix.cong.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoosinez.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruporosmar.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruposanisidro.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruppobperbanca.purnnikajyotish.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grwmvuanlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grxgplcpjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grxsegbdin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gshouzwttm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsinaijgne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsjnvnznld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsncouhpkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsoisipzto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsorcmctya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsqjgjclbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gssispxzll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gstgescutw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsulgbqzie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsutfgpzue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsvmyyemjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsycisuowk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtbklcrlaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtcjrojdwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtcxsvsutz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gteweydael.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtgimrlmnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gthmmrupcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gthprxjnnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtigrovvs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtixnfxudi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtmhpknxan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtprylbjwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtqbtqsoyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gttrcrexsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gttunqniox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtwmnnglob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtwqahvpkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtyaner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guacharen.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guaxuqpygc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gudhoffryt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gudhquzewp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guftoirora.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gug7vqvhncg2a2e2iqcs7ecynnn5cypwloxna3gxfp5rcihm-ipfs-w3s-link.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200009294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guiltless-strategy.flywheelsites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gummyoutgoingtoolbox.daviplta.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gumskar.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200009297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gumtree.order912.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200009298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gunejihhzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gunxxsvyfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guprosselecto.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guqeoncpgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guqhdirvdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gurukanth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guttercatgang.free-drop.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guuojmhtku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guvlrlbjoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guvmvzlmgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guymvebqaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guypgziwtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guytghoeru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guzhcctlge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guzzqsycij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gv30e4r9gf-j3wr4-gfvn-wernjvfc-enr-ngv-e9rnj-vrv.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvboihyrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvccqpugjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvcempwfel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvgtkorefc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvhwblpwwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvirmjrshc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvlmxdapoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvmhbvnubg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvprnjnwyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvqdwrfgpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvqypusgwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvuyguhhqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvvrmvslex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvwuviqacy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvzfyhkvcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvzmsfwxhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwafaiqqcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwbuesvdho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwcxsqftjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwddouxmuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwen00000007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwizlcuxgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwklynazer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwmbsgioht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwncbyncgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwocnzmmlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwoxlxhihr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwqjjslzbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwtprjvefs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwvfuipyow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwwhsjreng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxa1ij.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxedqmyxlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxfwtwakxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxgjlvnokw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxgzclrtgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxjanzhorj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxjjosebjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxjoxgsmgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxkxkchyen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxmzvptjem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxojfemszs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxpblqrvyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxsaaolwjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxsguflqxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxukvfgtzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxuphejxdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxuzcgvkwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyajruqtsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyefimxzzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyfthmhvgjh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyiacwwcdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyibnjxbyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyjfkqztkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyjxzqlufu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gymyaetcko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gynocyzpbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gypsysoulatelier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyviesaipk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gyvrossbue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gywlolxnic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gywsrkkebr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzabjnqznq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzanstptmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzbbffjqxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzcmikdcwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzcxzccnge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzdgiujoyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzdvlmtjgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzemiwqjmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzfurvsimx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzgwjvnnve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzhlqkikof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzhmktaxtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzkgwwleqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzknnvwemt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzmsaqfwoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzmshrwzcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzmyjd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzmzqjupwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gznkbzluug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gznxksdltv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzqbrgtaad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzrkafcelb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzscbivwjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzscyqlvmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzsgvltkaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzsjmdfnzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gztmajvmum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzuehbbstu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzwiiovyhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzwoidzyis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzwtmxgngy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gzywhadnjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h1catamarca.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200009410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.b2bxjea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.coinbaive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.croknqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.fxzqpgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun18732.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun37352.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun58122.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun68299.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun79595.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun93676.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gobsaym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hiflyk28075.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jhafrwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jkozclh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.kgoumav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.mhevtwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.miaycel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.tmaeqcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.zxgiqvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h9is92.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habbocreditosparati.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habhldhoin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habi10100200.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habszbkpos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habuvbwyki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacedordeaventuras.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hadeedethopia.nyatechservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haejpalcbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haenzyvwjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hagbsaxuhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hagi77.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hahdaeupdate.es.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hajwnvbpor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha21.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha23.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha24.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha25.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha26.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha27.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha28.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha29.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha30.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha31.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha32.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha33.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha34.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha35.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha36.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha37.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha38.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha39.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakdsjxajm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakzycklld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"halibotton.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hall-arch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haloujie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handakai.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handvina.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hanfwlcods.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hangar63.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happy-booth.103-186-117-162.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200009474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happydazecostumes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happyvalleyvapes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hard.metrety.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"harden.jkub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hardxjyesz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"harochngpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haroldhazard1-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hatencioncliente.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hatocorozal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hauhiekfat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hauntinguncomfortablelevel.banescpa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"havnlwsnpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hb-106001.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hb-sgb.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbdrkhsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbeivlkomn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbepbmljnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbhawkpvoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbhkmuhdbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbmxrlrhsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbptdacbyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbqebgdjrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbqvwlfnwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbtdjvczpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbutjjamoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbuzvsyjvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbvnhqpjyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbwjarabay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hbwvvpxdac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcefhnxyqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcfwbfcqwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcfzwxlenl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcgodkrqqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hckxgewymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcnhqewvxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcpimhnwnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hctlbagomf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcufksllxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcwyduzueg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcxewwzowr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcyafupwig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcykjfqqvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcykvwfhvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hcyrwozlin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hczrlphzeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdaximegpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdfooonijy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdgyrxokea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdmas.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200009523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdojbedyqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdqjbdyiqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdscgrkhce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdsmtstmcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdsqvunxte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdvidbhiru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdwfwabeux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdxiiqcvwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"head.lowhood.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthatlums.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hearingaid911.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heartfelt-lokum-857554.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heartworktattoofestival.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heberlonsionag.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechoparati.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechosoloparati.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hedefpanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hegjmebohp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heidxgffot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heinthu1.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hejsxjapmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hekhgaeiho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hekxiyalla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helen.wang.hfhboca.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200009547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heliumwallet-minersyncfix-247.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helkngnqkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-post.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hello.rkk-ev.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helloselec2.sessionpri.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-vystarcu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.insecur.saftyalert.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.validation-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcaseid.1009156015961410.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcaseid.100946104856060.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcentercase1000206111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpcustomerfise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpdeliverypackages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpid.100946104856060.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettaa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettaa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettacase1000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helpmettacase1000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helppadrestricteed.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helppadrestricteed.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hendaklahengkau.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hendossvkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"henerzerga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heognqclud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heonjzzbvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heptprfwbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heqnsyqwbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hercarresf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hershays.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hertzclubdk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hervochapiteaux.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hesburada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heuagkbgcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hexqgfssgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heybear.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heydayz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hezlrhwntj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hf8u99.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfbanjlaud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdsgayjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvc.yj6p41y.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfexlvpeax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.djiguyk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgyfhpquc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hflcxuhvbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfmiehrpxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfmquhtadl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfmzoggxtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfnysbizuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfpzyqfdtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfrdl.omoism.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfrxlokswf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfrynpwznb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hftqpyptqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfvefstfzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfveucbtzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfykzzzeyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfywnrqhcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566dh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566gx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgbrntalvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgbxefjxyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgcyikwacl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgdgdfh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgdkwwzvej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfrrljeso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hggqnsydhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hghkorea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hghtfbvspg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgicsyuflx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgjnoualjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgmlrilqyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgonmfcolm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgsxncsgiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgtjwieimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgxknylspi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgyiugiyiugiou.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgyjkoxnwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgyyrwknly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hh7n2-5yaaa-aaaad-qdrza-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hharmsrptk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhflgmfswy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhgepfzrxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhhat7.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhkvtrlyte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhmetagame.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhmwdupluz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhqsdhkfuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhscbhbeag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhtzumeydk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhvqixacmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hhxcyrhekh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiaxksehjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiazwyqiqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hicdafmixm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hico.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hide.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200009646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidelsxziy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidrdxrsfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidrejurka.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidvysgnbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly10365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly21173.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly27702.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly62556.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly85295.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly96975.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk47344.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifqxvegcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"highridgeconstructions.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200009659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"highstarsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"higotest.gyomu-kaizen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hihmpxyllm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiifmslwsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiiimnwmsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiippxgkmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hillandhappylanka.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hillwig-goodrow.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himalayansherpa.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200009668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himbauane.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hingehealths.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiper-consulte-fatura.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200009671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiper-fatura.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiper2m.taplink.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200009673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiqdjbqbgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiregroup.ma"; content:"Host"; http_header; classtype:attempted-recon; sid:200009675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hirgbeibsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hirshfields.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiscsilidp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hisoftsxwnf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hissfmablw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitman71hd-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiwqnrhamd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hixnlbdilb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjahchtxhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjdgfgdh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjdtoxvcey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjedrhfgre.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjejrwgtxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjffmnhtfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgsgjsfhsut.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhadveurx231.dynssl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhvfuugdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhwxkgycl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjkmjqpgjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjlpuvgqfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjnietajyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjpgiyxhhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjsacpyxcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjsgstrsg.x24hr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjvcobzfgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjwccxvoob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjztlwbqym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkagmyjmgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkdfvsvzoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkdoehbmxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkhbecshwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkiyduoxou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkjeuawmsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hklitjjssd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hknvkqavyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkotbvnmfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkpbrnuzys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkpqtrxldi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkrdyidygd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkrxiscpvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hksjwytsgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkusavvqfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkvfluyqqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkxmqzhuqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkzwtnwqgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlcazagfmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlcdukrbls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlgdxdhyxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlhegikwev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlpercard.netsys.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200009725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlpgbphnhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlqltjbhwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlqmquvyai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlulysmfdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hluqvbyttr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlvjohmjkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlvrwzzwwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlvzcdhtfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hlwnaoppmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hm.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmahio.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmcilgklow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmclixvoqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmcukzfccr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmgsrnxglz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmhghmqnov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmkgmtmygz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmncsojrkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmnlcvcjcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmpgbtmls103975.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmqqedltyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmqyfazkhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmwyexssxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmxctetxug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmzblxzgqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnaljueibg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnclkeldjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hngbdryecq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hngfwndhwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hngq2b.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hniqnqmabp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnjzqekdnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnklubjwsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnlxjuekiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnmfaqwyip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnohyjrixk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnuzonjbnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnvolhtzui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnxlatdfvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnyblssouv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnzeexjrcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hobzzdczbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hockbfrasu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoeehildvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoffyrdkvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hogdakzwzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoje-temos-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hokshasotre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hola-bienvenidos-iniciar.personasonline.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holding-energy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-brook-fe7c.set1s511135.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-disk-fe09.valeracooper00.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-pine-586f.mariosa5862.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holy-wind-f028.vgreengolf8866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holyquran.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home-5009984072.app-ionos.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home-nft-magiceden.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.br4sspontoscompany.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.centravirturest.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.gartenbau-stefanjansen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.portalgaliciaemi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.revenue.services.aing1.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200009787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.serviciosdigitalespichinchaape.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homebanking.macroarhb.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homebroublog.homelinking.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homegaliciaeminents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeitau-seguridad.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeofloveclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homepageyu92-108231.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homestayenglishschool.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honduasessor.ayuhonduor.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hongpham.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honosglobalcorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honostkwik.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honounced.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"honzuokatp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoogvmmybq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoouawvikk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hopeful-wiles.139-177-182-62.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200009804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hopxgroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"horjnlqhkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hosnbtynur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hospicesource-0utlook-auth-0ffice5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostingepagamento.viewdns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostings.kilinkis.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostnix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotel-pontos.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200009812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoteligeafiuggi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotelrewind.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200009814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotelxcaretrivieramaya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotn-immutable.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotrocolte.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hougqwmltq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hounbvc-c7661.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"house18.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"housemarket.imediasolutions.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"houseofscotland.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200009822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"houtai1.caymanverse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"houtai2.cactusverse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"howslife.com.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoxylxzsew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hozfzevueq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hozjquenkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpakxhztjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpbjkidiuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpbqtvnbox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hphxwdqjlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpinycpbnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpksudfusl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpkvwndgkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hplljhnouq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpplotters.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpqajqxaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpqkppzzbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hprt-4kvuhtyw.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpssxcjoea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hptlrubfys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpubzomwrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpvzajxard.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpwxfhkgap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpyxperctu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpzojbiozv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpzxqyzbks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqaeajdles.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqbapyjphg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqdgunggvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqfqdimnyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqiakyidnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqrurvcbyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqtickvlq3k.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hquwqzhxon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqxcxkbttp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqyyaftego.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrabs-sqiaots-jauesch.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hraegbqipa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrbzrbxbvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrcxmjyfyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrdrghuitv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrgeqhofjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hriorokhcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrms.projects-codingbrains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hroffice.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrrodmqcrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrsaedwgzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrxursuayd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsakeuazic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsbdjldinv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsbexpuvzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsbmzwsllb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hscdekgpwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hscfgdnmqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsdmuhmxzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsfiqhxtgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsgsjspqzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hshjzexeee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hshwcvorrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsiowovvtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsjtypqlbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hslptzjdze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsmdkgvmow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsmjbucwmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsmxptqsvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsncxqmycy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsogqrkctj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsqaurdkja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hssnpzxzoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsssoitvjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hstaitvjna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsvppjljdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hswpyeixeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hswqaynhrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hswuutnplm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hsxvfjsklw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hszc168.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ht-agoda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ht.agodahk.agency"; content:"Host"; http_header; classtype:attempted-recon; sid:200009901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htaoqtftdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htfjctuncc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htgoqgkrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htkeyetuqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htmfdvsgqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"html-update-okay99.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"html-update-okay99.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htnesguapq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htntgtgn-huntington.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htoaekintu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htotyrtoys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"http-102355looftynain.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"http-104164manahgdfsttt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"http-kdjhdijnnkkdkd000kjg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpeugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"https-104745besyhjlhf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpsfojrhdnfhgcom.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htulwoylry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htwocnbypb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htzgsitvul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htzjopscgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huangxc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huaubahbdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubfalcfnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hucycbyxol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hudrbddbsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hufhhmqgnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hugmhtnmbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huhhhhgyxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huhiruzdkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huifd4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hujcqjtgvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hukiuldoas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huknzrgeqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hukwqqtdpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hultglaxyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"humbleguatemal2022.corporationsbie.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"humzdexqnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huncho.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huratxjiaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"husiwei8.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huston-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huston-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hutoknepper.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxifbdaix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxvnnalur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huxycvrsni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huynguyen2k.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huzagzvkpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huzjizhhmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvbvzqghto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvccomeblt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvcgeqqdjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvcjocqkbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvevyuocsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvhbivtjyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hviizmltul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvjwdntmye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvmrezzkjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvoobbqbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvqzigtnpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvricogdku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvsdutyump.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvtrbpoupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvvxzdliay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvxcqqdcik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvzuhdnnac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvzwpbbvqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwaesidmym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwbjkaydtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwclcnnjkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwebotozzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwfkqhlmav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwhhnpanlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwihu-b2973e.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwotskaanw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwrdwsuvua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwwdpvlvzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwwvhdpvbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwyazmfcvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwytczkary.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxcjvczwqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxdflgmmbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxdxfqzxaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxfejemwqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxoqraimut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxprjzskfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxqainuijk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxtlavixwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxvffyuood.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxxdsdfzxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxyvrmvfiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxzthtbygm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyapmqf.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hycktbprnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyckxirpvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hydnocrpwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyecmvquls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyfofcnvcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyinvcmqgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyjcwgifch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyjkwwjhqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hykdsukjde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hykjbuobxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyknfzcvzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hykyquugza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyperx82hdas9o.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hypnobirthinggta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hystfhzgcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyubrlvtfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyuvkcpmna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyvvaapxyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyxcsbmlkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzagyentof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzdkpbtsia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzeylzzqpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzftfqouqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzgtftiwni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzholtbdkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzjoabervd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzkjbjcqhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzluxejitq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzneyimitr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzpmgrsita.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzqewaewxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzqvdervuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzrvphswlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzrxalukdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzrzrjgqzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzttqtxyni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hztuovpiqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-ask332.dga.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200010036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-auth.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200010037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-tps.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200010038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i.gal"; content:"Host"; http_header; classtype:attempted-recon; sid:200010039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i.violationspage.validationspege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i0n0s.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i1club.uksouth.cloudapp.azure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i29092022.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i7uhgfvdsfre4rhfbvlhgdfcdewfhjkuwdawdhjukiukhgrhjukiikuh.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iacujzocqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaemgfbfqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iagascpbfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iagdykysis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iagfswrhkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ialxxcafdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iamfarhad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iamqllgqwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaoigruynq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iarbujroyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iarsowuczv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iaumsxwhrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iavrzocdfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iayjjoikzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibbbkbkbfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibdazldymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibeabzltfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iberostarhotelsresorts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibfkjietem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibjqxgmlch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibkzqefhcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibniuxibfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iboovggeqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpobaqltg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpsconbbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibqflsngya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibraibraa17.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibraibraa170.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibrxicawwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibstoshrtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibu.com.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200010076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibuothjify.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibvxtpyspr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibwhafnrrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibwshqdelr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibxcyeatuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibxharpkbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibxkmegbag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icaeapsiqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icaremobile.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icat.tg"; content:"Host"; http_header; classtype:attempted-recon; sid:200010086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icccokbrcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-ie.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-ie.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ice-poker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icentra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ichosenimports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iciikympco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icncfqleiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icqthvfegh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icrrczgbbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icsconsultant.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icsrvcceiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ictworld002.tripod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-base-c058.housewin7892.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-block-93df.edrees368.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-lab-beb.ukc904io.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icy-wildflower-3f00.rlautobody5397.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icyljjklkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icytools.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200010108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-000064updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-64300000-updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-bendi.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-bendlgo.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-gandi.uv-i.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-optus-verify.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-web-go.mizuha-bankjp-aboutax.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200010115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id9658.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idbnycicgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iddaigacbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iddhqfbzry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ideaarquitectura.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200010120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ideissuyso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"identita-csob-cz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ideomaker.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200010123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idfwqfmxth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idgbduwfty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idhiwzexel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idillphdmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idmsghirjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idncknshcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idnrqwkhxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idobeamolax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idogxrujas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idolnutrition.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idonzqkfam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idorautahat.madhesh.gov.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200010135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idotiulsom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idpwyfqpan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idqmczducb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idribviuoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idryvamyoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ids-s.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idverifikasiakun.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idyfsuqrlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieiyfjemza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ielgvmaqvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ielsckcvbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieluisfelipecenteno.edu.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieos.cefsi.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieovvbmarp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieoyutqdun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iepsanjosemiguia.edu.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200010151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ieqoproucw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ierfyitaiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ietsenfiww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ievycaqbhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewflbfrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewojmsykn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iewpkitttv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifibybo.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifilgglvbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifiyyopnje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifjsljasoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifjtavcljr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifkoorofxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iflacmetzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iflbetwibh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifpytwihfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifqtythfiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iframejld.avent-media.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200010169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifrorjoaia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifrybzqfxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifsmvezfzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifufbrofle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifuwdsaxjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifwiqdriqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifwpbxqfxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifxbdtnhsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifybfrzndr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifyvtwddyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igaydsikfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igdyxukwzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igdzpedcqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igfap.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200010183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ighfgc.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iglpkfeddk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ignsgrwbhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igotinnovative.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igotpgcfxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igpmyogndk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqokg.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igqtbbljgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igsolthermsolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iguyihsnzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igwnfjgard.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igxvvrfcdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igzgowsnjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihanbshvfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihhjpwkmsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihhsnkylde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihkgpjvgdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihmbnceucd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihmoxwbvbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihmtqyzegn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihovimbsyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihqppwxvqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihulbetgpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihunruwred.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihuwugidvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihvoysgnsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiagegipjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iibxwrmhqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iicconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiefdxomyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iieyzkhojs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iigppikxwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iigwxxlzwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiketvbumw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiledmoezr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iirbghjria.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iirpssbsca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iitauverifypy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iitjmenzcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iixqxesjho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijazlsagha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijcdweybgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijebzmfayj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijguxfcgsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijhbgusfgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijizkdezbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijjnveopkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijlogjtwhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijmmhggegw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijoacjomxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijppr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijqkrcqirn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijsjzuzfiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijsowuoqpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijsvrqabsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijunacqagj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijuwmuutpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijxaotaljt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijxcsojwxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijxjdjncvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijyhobqxnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijzekujkmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikcejfgksf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikcodppwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikdpokegrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikdvwetovi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikjbgfvpyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikldinlaev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikltiofomr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikmwesxdju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikqqrajzrt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikvaxbhkfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilanbuy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ildfvefqsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilfurxtyyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilghvcyrsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"illmcpdpbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"illuviummio.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilnapjmbsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilnjceoqdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilohbajxyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilqiqrfqqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrneammsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrulbwdze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"image-apparel-solutions90389.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbibetechnologies.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imcazycwcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imdhxfjnma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imeoxpjgga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imepwcpxls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imeyjcfxuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imftwvhdyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imgeweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imgsowjuff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imhzuozhrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imjuzedfas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"immediate-tropical-collard.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"immyavxpfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imobiliaria-cardinali-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imojmookua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impiana.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"importvalidator.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impostaverifiche.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impotsgouv-france.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"improva01-mps-0510.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imqtzwmsjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imxwfqrcdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imyrjtcpcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imzdlcodow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"in.podlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200010293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"in4ou567twch.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inaicwpldh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inanhd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inanotoekspertiz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inaxbeoyqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inaxmhvaeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inbalqanoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inchirieri-limuzinebucuresti.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200010301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incomeviaonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indeed-6aa94.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indeed-f3c43.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indeedsupport22354.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indexamfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indianajons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indigoswap.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"individualni-klient.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"individualni-klienti.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"individualniklient.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"individualniklient.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"individualniklienti.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indmobilelegends.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indphgdovj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inductionfurnacespares.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industel.co.uk.gridhosted.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industria-bilinea.bi-enen.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industria.binlinindustria.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industrialseguridadbancaria.seguiinduris2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"industrias.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indwecfjud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infallible-chaum.109-206-241-201.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200010323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infinitepet.petservice88.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inflfexvyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inflixty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-bendigo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-mon-orange-portail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-sg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-sg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-sms.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-update-78432.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-update-78432.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info-update-bankofamerica-auth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.20-237-235-240.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.51-103-88-124.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.dnb.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200010337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.miizuha-bankes.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200010338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.miizuha-bunks.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200010339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.perusalsasda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info1226.systeme.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infobper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inform-01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inform-01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informacionesdaviplata.daviplinfor.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informaciongalicia.inactivida.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informations.recovery.confiryourpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informationtaxcase.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informazionecliente.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informcolpatria1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infos-novobanco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infra001.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infuentes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing.es-direct.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing.es-gestion-clientes.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing.es-ingdirect.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghodbe-8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa1463.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa212s.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa2213.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyphet3654.0hi.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingres11loshf.ingresbankhome.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingresoseguro.jobrefrigeracao.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingrskac.inunales.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"initialredwoodtitle.retool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iniulvcxdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inkboduqvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inkdzfdzee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inkqsplork.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inmobiliariaalfa.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200010371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innerpowerjourney.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innndzlkhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innovation-evotik.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innovationcircle.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inogvtgxkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inoiicoeytfjdtvuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-asiw.order709.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-dfie.order9347.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-onem.order9572.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.okmli.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.poas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-my-id2g3ys.oferta.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200010383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-my-id2g3ys.oq7.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.oq7.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-xz5512.rokus.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-zai.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl.payment003452.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-gg.order142.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-xm.order943.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-rghl.2584902.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-shopping.43222378.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost.order525.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inps-ep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inquiry-package-usps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inquiry-package-usps.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insdustrialseguritybank.isdusss12.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insetti.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200010398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inshredirects.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagram-secured.visionofvisions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagram.com.bedrijfmaju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagram.orvilleyang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instagramv0ice.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"installodoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"instalogin.dotkom.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"institutodeolhoszanin.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"insurancetrader.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200010407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"int3eractivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intbper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"integratenftpads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inter.prestamosper-sonales.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactive829a.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrokrers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrolkers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interadtivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-ingresa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-personas.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank.banca-digital.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbankempresahomeweb.gemsaweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interline-asia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"international-c.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"international-package.pubchaplin.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200010422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"internet-mynab-personal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interspar.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200010424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interwebcancadigitalper.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interwebcancamovidigita.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intitzipqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intl-ppyal-securedata.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intramidis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"investecfinance.co.tz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"invoice-production.chat-verify.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inwmartrvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inyejnydwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inykgnimcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inzizi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"io-magic-eden-yo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iocqyntnmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iodcflrout.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioftsqtkkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iogzubjroq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iohbyofmjw.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iohbyofmjw.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioiokvscfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iokeqncuac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iokomrajoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-email-settings-workspace.squarespace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-mein.webmail.de.flick-fix.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos.zimapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionosionos3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionosionos3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iooiehzhyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioqkymmbrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ioqpaigaww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iosaaceapg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iowrwowcne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip-172-22-ch.main.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200010457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip-93-212-ads.main.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200010458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipbqqvntzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipcad.omoism.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipfs-fleek-co.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200010461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipgayycjvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipixacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipjgvejdnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipko-biznes.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipkobiz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipldaxlptd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iplogger.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipnqzejien.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipohxwnexe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipvpn055172.netvigator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipwuorkqjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipzscsusds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqawmkmznv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcnpfzpos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqcu.4dq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqjklwfsge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqkwdjaqir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqnlbtgzmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqnllevpef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqpbonyzst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqqzjmzvkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqtzozsmgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqvqcqrukg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqvvhyfmjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqvzfyuabl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqwknxnauf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqxoohudst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqxyuauzzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iqzlqahtxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ir53rd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ir53rd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iracema.rr.gov.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irakszxjny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ircvnhfbfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ircztqptxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irelandsissuesmagazine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irishjewelleryandgifts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irnebraska.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ironcladscaryverification.c0lpatriiac7.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-federal-taxus-information.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs.primeramfbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs24hr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsdraw.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irshome-federal-tax-usa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irstaxlaw.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irwwxaxqvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaacanicama.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200010508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isauzmzomf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isbighcfqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isbuboalwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isdygexohj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isghvcjfdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isguypmzwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ishespizlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ishr.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200010516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isjjrcdtjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"islvyydejs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isnzforfwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isrcwobcfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isrtiauijb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isrzqzgijw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isuelettff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iswokfvlbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iswvoxcghn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isxswgirsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isxykfokg84r.martincaldeyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iszszsdurw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"it-bnl.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"it-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"it282.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ita30horas.3utilities.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaewonclassinc4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"italftgwha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"italuu.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"italywinemarket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau--000000.royalwebhosting.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.conectcar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itau.varreduradeseguranca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaucm.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaucorp.rentitauuy.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauparaguay.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupr.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupyltdaa.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupysecurei.byethost4.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupysecurel.byethost7.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itaupysecuret.byethost8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauseguridad.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauuzemakyhsht.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauvalidar55.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauxmx.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itbwaynczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itdounmowf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itdzenjyoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"item-check.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"item.opensea-io.c2111664.ferozo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ites754754833495965815dashoardeditorpage6be553.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ites75475483349596815dashboardeditorpage6be553.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ithfgqftgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itikllbwpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itkecsngom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itqdavalcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itqsvabpzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itrbyhpuhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsewivhtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsmdshahin.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-7ade2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-7ade2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-d12d7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-be-d12d7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-carte-730f8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsme-carte-730f8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsssl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsweblook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ittsglxxjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itugzzbnbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itwjjbtrpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itxuiquxqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzcdjcjjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzdjpfabl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itzhtljtiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iualtlqrpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iudnvumhym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuegnkqzas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuhamhybvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuhjdafhn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuptnjowka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iurl.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200010588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iutshdjgqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuxlqcrszp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuxydqykng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iuznkxlpev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivaanwkhev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivakgvbczm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivbzfeyzyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivdhurkkci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivdoykhiat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivfcentreinindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivhosqznhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iviewing.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivksdzlsoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivlxxuexkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivo-becker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivxfrxpcpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwagicvuow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwbbvjpxoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwfxjllwhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwgxvwakuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwkomiqgus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwkszmwtbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwmkctmxyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwnfeqxuje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwocsvsisd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwpccpoook.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwqodvsetf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwqqeuhtmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwrjnpjxvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwrvelwuog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwshqcbmcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwsxjacxve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwt2klhdfkd.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200010621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwtcgeudod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwuwwnfpdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwxepbrsbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iwyyotmpej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixbldbscux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixeabpqglr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixeoudcjkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixfdwgzcmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixltmgsfni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixmluazawx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixpyrwmuxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixqjgfswld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixtldfhtth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixuinplscf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixyqbxvaxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ixzuoqmobi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iy3lkqhdaloi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyalmpgxgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iybwzuvmyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyckrmsvek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfbywmlbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyfnxsqlut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyjcrncppw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iykhgknyup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iykikmeous.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iymfdxjpan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyouwsckio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyozzbpseo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iypaombmxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iyyytlsxhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izaxkbsfpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izfrwwqhwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izgkrouphq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izlczgmjno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izmelntqtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izomlhmiqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izpcnfense.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izqfcfeemk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izqigkzgld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izvmmhydyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izvmmlzvyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izysmnmook.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"izzebcohmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"j24mo.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jabvylmsnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jacksoncountytalenthub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jacobliston.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jadezwispb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jajaja2121.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jajspbbhks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jakelynnmusic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jalluzxywo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jam-023d.gitlab.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jamdszmkjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"james8.aidaform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jamnetnetservice.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jandrtrans-0utlook-auth-0ffice.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jangnlucint.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200010680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jantogarrucho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japan.netbk.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200010682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japan.netbkjp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japan.nktbjpbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japanese-batteries.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"japezwlcey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasa-antar-jemput-laundry-sukses.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasa-bg-kakon-keman-aj-45676748767.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jashmbaeva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaslavrxtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasting3u74623liv.ilgins371.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jauhknjmjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jauzapzayu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jawqyztzvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaxrqgmjib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jay-shelby.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200010696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaybbcdkyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jayughulau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jayurbatqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbaczjzvyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbagoqhspv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbfjvbspbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbfnmdricx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbifaxflsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbjehgcjvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbjhsrgbhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbjnttwqeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbmugeuoyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbnphpssde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbqqrlzmvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbrefrigeracao.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbrogzmvdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbtbucmcen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbwhpzrbnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jbwjjsczwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcbhzonrjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcbkeqalla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcdycxymvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jckfirs.punctulcentral.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcpzzqyvvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcqkohovcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jctblvspuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jctnawvidp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcvwwllrev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcyqjqxvph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jczdahidlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdapjstymi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jddotbqhvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jddzafxcyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdekkqvxij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdfhjmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdfwltwyhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdgpujfqtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdhtlycqoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdjhuomzcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdliuxlmmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdmmepnlhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdmzaugomm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdrogzomez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdrpapfmbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdrpscncma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdsbekeqgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdvwtgaefw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdwqfenvic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jdyqimocpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jebhezxjhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jecgylledy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeftgmwxea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jegggqwbuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jehdomaqfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jehydgvjh2.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jemewuzmex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jemtozomgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jenny-fcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jeoxmfmpwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jerryscaringhandsofdc.jerryscaringhands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jesqecknql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jetser-electrical-supply.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jett.gator.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jezykqqgun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcrdefxbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcspnkhrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfdiwdvswo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jffjkvqgyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgmgonopx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgoenzcpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jflkp.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfrmymzwgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftodmtawe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftwwzbgwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfuheepljh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfuvmhlibu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfvcejrvlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfwjcoyhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgaalskxmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgbvfchmzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgcmlfmtbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgcooamlxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgdvznmskg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgejuchxgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghjasfxjahxgkvy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgielqbygb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgjkahvoan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgkbqkryhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgoiyxcxgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgopfdcjdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgpmbolsbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgqkzrjnuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgqwitepkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgxgofwdmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgyhrjyoxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgyrzeunsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhcexumvre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhcifdzbhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jheysdemsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfmbtvheq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgbhxcksp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhggfssreg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgrtyoliutry.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhixlpuczu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhjyvclwqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhkerlueva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhku-105507.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlcvcoull.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlsoyxyfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhlwnjqhwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhreamajdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhsbxarqjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhsvalbvs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jicqtoxikb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jigwuwbwlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jii.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200010812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiiecimomd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiipfllskj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jikapremny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jikbdhhfzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jimddgrgbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jimnrykzih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jinnycleanings.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jio.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200010820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiosms.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiostore.digitalhubstore.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiplchkhub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiqbmfsnrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jisudvigwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiwsrdigwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jizjxliidy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjdappkuls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjgdldezte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjkkzkbvwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjltijhriv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjnekblygj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjrqztzgap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjumbcxoza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjvehxeomz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjwkfvxmfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjyphqbvcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzefmqnyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzvnyhgaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzwbswqjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jjzxxfycml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkaclmwwpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkakjdwgbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkeliuqpaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkfupwbtng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkgfhrhvh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkheyoftui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkhgdsj.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkjdbphfhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkjllpdivz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkjmkikows.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkktpztqxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jknbfvxqei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jknmqubtky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkohegpxfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkolawnservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkrxkuatzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkuhaxlmav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkvfdrhuwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkvmpkdgii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkxszcuscc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkyaruounx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlbiurqlci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jldcitcjtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jldjxswtlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlghksovwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlglyximek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlhbnwftcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlnmiroauz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlpsvqixyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlpvjecdmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlsiqmewjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlullykcrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlxeyanuza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlxkwzscyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlzbprynih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmdrypmrnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmfonhercq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmfqisxdly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmhisktbdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmibhpylbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmltyalbhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmqaclsskx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmqkxsslfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmqltzkjbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmrdlrxeau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmtzhpqeeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmv.2p0kt9y.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmxkypyhdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jmywcxlghg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jncexchange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jncoser.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnfevbikhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jngeiszarx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jngwslj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnipspexav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnnmrqymzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnpost-merchandise.2221342.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnpvdhzygc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnsudawhcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnurkhozlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnveaixmow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnweevlozs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnxtmcyxaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jo-dead-ho-gay-that-3.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobhubindia.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jobjlkbbud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jocatlneut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jodekyrgzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joecamera.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joefoxphoto.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joelmonty.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jogkpemfqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jognwgrlxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johannabraun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"john-ashley.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johncookattorney.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johnsfingroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"johnytim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joiatrrcxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"join-puretap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jolmhieyit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jomavi.edu.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jonathanhilton.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jopjydiqyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jorrrspxss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"josqkkgmvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jotwzytbfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jovanelectrical.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200010929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jovqwfdisb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jow-japan.or.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200010931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jowhmpxmue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jozodqhgzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-hase.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-idraknteoinof.xutvbwd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-idraknteoinof.ykxtqlx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mercarli.ozme7k.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mercarli.py278t.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mercarli.sapx2x.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mercarli.tgf95s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mercarli.x6xue3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.c51ocz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.cn456w.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.fdw5tr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.hjfn37.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.jof37r.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-mericarli.l1013i.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-merioari.0bu7kw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-raknteoinof.adzhihu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp-raknteoinof.lilyverse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp.fzebay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jp.mercarli.xgi102.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpeoziwtsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpeylrzzro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jphjklqptc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmc-unification-uat.eventfarm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmkhnxiga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmorgan-sign.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpmunanqta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpohauvwkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jporsfmuxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jprncvmktn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jprvqkfcak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpwvrztnic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jpxhsuiqum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqevdwbjdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqfjiqwdue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqhypfrxuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqjfmbbphx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqmzmzxehp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqofogqscb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqqpihhaki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqrxrqnrej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqtrndbvsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqyyvoadst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jracifagje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jreast.co.jp.waizao.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrewjgogxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrfzsbdsvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jriioaqigm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrkjpelpni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrlgobjcie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrlrlguivw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrrlclgnnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrtjycyluc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrufrezets.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrxjcwucot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsddrovijj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsdeatmbge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jshcgjjaoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsmjhjqrrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsrhjjginv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jswhmcxdoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsxbxgxvbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsxounairr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsxsvhufit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsyafsirdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jsyjrhfmez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jszduanfuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtemwtgoap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtfe.scendo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtfjmefgml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtfkrtprlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtfqoimgzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtjbujynsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtjnlogvhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtkphpwylh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jttetunxlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jttfjshzmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jttuedwxjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtvljagneo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtvvijbzqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtxkgkdxxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtxlnehgvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtxqkgkvcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtyigtfidz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jtyrg.tl1sc905y2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juanesteba.xiaopangkj.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200011018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juevdmohtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juialaq1819.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jujxnwgftt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jukirmnsaterno.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juliegr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juloicbcoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jumeirahye.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"june.document-project-list.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"junrvdwllz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juokzncsea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juqjphwwrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juqwzrqfgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juqycotzcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juridaois892nba.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juryocsvkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justsayingbro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutughgkkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutyuaye378ahsd.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juwnylmulm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juyxlllxjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvakmjbyqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvcaadlcbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvgcczdykv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvggmjqigm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvkiczhxhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvkrmbvyaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvlusigppa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvmdaextpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvnyjdvljs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvrmofmtfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvssgoyxqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvustcwmdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvvccfxhjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvwcivxrjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jvxomxomgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlafgvwyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlcjmkbyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlmdesyhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwlqycgytt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwngslesgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwnjahcxhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwoypwivsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwpjnrpnec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwqxuiduab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwrnotbsfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwvlrpcavk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jwvopkxpss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxblmjfeao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxdlmdrfwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxiinfingc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxlwjoxnop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxmzvlsorz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxoykxmycf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxqjnbbmfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxqlkeixps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxuogltqgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxuvloavym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxvbegkqhr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxwclrjvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jxwqujjdho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jy-mingchang.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jy78.n0ed.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jybfavdhgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jydaqepsfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyeue43rm95p.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyfhwkklkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyhpglpjyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jylgalljtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jypbytbitm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyxz.donular.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyxzzslvwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyystebcjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jz2bab.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzajpnygij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzbhyxfykc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzdqeoekwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzeosmpbsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzgcdwvrdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jziakvarjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzicxjykls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jznmnaaamz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jznsbzebcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzrapzdyfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzsoucdcrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzsyzplpvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jztvdgjlgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jztypldghf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzuenfyaku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jzwetrczrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k.axsct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k3ja6d.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kafena-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kafkasariotel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaharaerad.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaijukingz.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200011113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kajqhfhddr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kajzptpwbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaklkoiwoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaklzxmbqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kakmnezarabotat.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kalveasrko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kamaltraveluk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kamervankoophandel.klantnummer.109-71-253-24.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kangabooking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kanrxcslhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaqfxzutkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karacol.ind.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karafuuru.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kardiologiebadkissingen.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kardus.anakembok.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karenportww.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kargonova.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagerfeldshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karlszkgxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kartaltepespor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karteauf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karuekyaqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasarqfwsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasba.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasqzvjavq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kassoatwtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"katabitc.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200011141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kawahara-law.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kawzwjpahd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaxmlnytsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbaredesigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbbpohqipj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbbukubole.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbchtdrvxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbcixtzrnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbeicfmbbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbeikmislr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbfvjozkyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbmjczbgtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbosjdahgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbqocfcbpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbwtmlfocj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbxwypvyjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbyqiyvjqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcgssgaldq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcgyubjadj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kchsijqwyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcjinjebgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kckxsisvti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcmijbxihh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcpphjbhmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcpwr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcqppiopex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcrslwhgjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcsprllmsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcyavbmkcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdbtwufrxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdcdjrnzyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdcfnrwbfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdcjhuhran.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdedftcbbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdeegupqku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdeetvwqjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdikfiiuoredhj.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdlscaffolding.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdnhnrggys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdnmmfrzou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdxzlujyrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdzyvsxatt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keadaancus.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecmanijada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kedarshirodkar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keen-antonelli.49-12-106-1.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keepsafe.z13.web.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keetjoxech.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keevjdyrod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kek-technik.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kekrnynemb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kemlidarti.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kenalred.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keqghymiop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keqkpgmzhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kestdqbtvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ketccfgxyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keuwkzawdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kevilsvjno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kexmtvmgpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keybolivia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kezlytpznf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kezyjciqwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kf-p.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfghorgqzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfhfyzsldz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfhqcocqcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfjrfkglzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfkxqxmubu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kflagjueba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfnqzxtfdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfomkyhmzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfpobmivkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfpvygtdxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfqxlqehny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfrbkisaqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfrquekzbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfsqynyfry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfuzfrfvhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfyklptzpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfzdvwtjcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgabwbzupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgbmaclixj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgejljaknc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgfutpexwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kggmxihsyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghtxcriho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgjjqtgnxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgkfocwfqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kglvcbcwsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgmdobwrkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgphjrtymc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgqhfmhfuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgrsyezwdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgrwuegero.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgscgcrytz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgvtvgcfgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgyvawkovj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgzjkoperp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khabar8pehar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khalidouhdane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khbznzpxgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khcpaacsft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khdeefsxwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khdsjkghaui.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khfvvcpwge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khiikcsibd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khiwbmnvxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjilyfqni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjshamsxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khpcdilbul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khpobinckq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khsgqgymjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khvbrmcwcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiatebyygu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kicksmandu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kicplheztu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kicuoslhje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kieahxcdew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiedgwpxcfehkkzxjyc6i3reqo5u2wamqgxgrugkjh2fswvjazwa.arweave.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kifpmxpnsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kifuduadfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kihjnzwvvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kijomlfswv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kikjkmjbew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kikpbeugut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kil.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kilo.annivstars.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiltifwaxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kimixeanbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kindnesschallenge.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingkenzyylastcardcash.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingvel.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200011275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiorrsfqss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kipenmeer.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200011277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kirihuthjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiscdzloev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kishwifi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiskwtgcpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissmyball.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kitaroworld.wl-premints.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kithocivilengineering.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiwi13717505.brizy.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjaxahnuzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjelrrnyho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjgwzcdzjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhdfghkjhgf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjipjwuexm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjiyzktkgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjjhtrkibg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjjsdkjodx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjljvxurpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjnhbvnnnn.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjnwbzopqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjqnlygoqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjrgbykyjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjsbqleppq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjslnachgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjsmdarkdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjsrztzndt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjulsqitjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjxxtwfkbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkbiicdadk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkcgqyotdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkfooatilj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkfysbslnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkggdwiotm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkgnzwjvac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkjazvaspd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkkayyxvrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkllxddqvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkoyhtnrlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkrmtouflg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kktafnduoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kktdkxqdqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkutylsysq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkuvxypkrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkyaoqngad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kkydpzatnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klacqouhan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klaimchipgratis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klavierunterricht-neuss.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klbpzxzodq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klctoiqbfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kldltqwwzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kldpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klfglnfavt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klientin-lieferung-paket.healingtobehappy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljfdtstrlnnv.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhfgdgjkl.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljuqajuuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klmediamachine.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klockorochsmycken.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200011336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klogrkatpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klos89.lajsop78.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klukiuraiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klwhwgfhxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klxphiogdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klyqloainm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klywunodwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klzsufdbwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmakeitonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmchlkfnph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmct.edu.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmctayurvedacollege.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmctcoeemergingtechnology.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmdnyojpnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmewvepjar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmlhzrqldl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmmgwgnety.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmnrtuwhxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmpsykglel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmvwedjfkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmwxlwpifz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmxdwszmpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmycmkbemp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmzsojautz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knaxwpnrfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knbfsefrdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knbooapbdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kncdsxuqfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kndsoskuwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knfbjeooer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knfvpzumik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knhzvudmxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knjzsfdakr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knndjyqpgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knobbytidycopyleft.eqwewqeqe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knpbqabuaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knssjypkqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knwwwbwzoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knygbekfsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knykskzkyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"knzfvleouz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koalaagencynfft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koavqlnorq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kobe-denki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kocbpsuhly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kocsymcoyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kodera.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koerich-c-empresarial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koffkortdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kogfjdkaqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kohbpeucrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koigkujsvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koitlzguxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kokcbxaopb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolachristwealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"komdxkioab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"komijbcuej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"komowvmytc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"komzbztyjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konfirmasi-account-id1.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konfirmasi-identitas-facebook2022.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konfirmasi-pembatalanpemblokiranfbid002.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"konuzxbija.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kooky.03456.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koqujiamax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koqxejfady.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koqypehztx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"korsahlaw.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kos.apa.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koteng.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koxhcqszib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koycqwrbsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koypes.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpadk8hzrzsz5zjkyk1gea.on.drv.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpbaepfbhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpdemdbplf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpfmslecmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpgjahvqhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpgtaxmkjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphcjrjccv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphfxkzgcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphpjnrjlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kphvidyebi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpifciutgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpmlsqdtvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kppizi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpseivbdvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpszkqvang.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpvbfxwlot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpvqdjfewd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpyrqqsixs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqbsrhciqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqfsjlvjnb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqlhfxfgvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqlyfuvjjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqmpwedfgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqmuzftrtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqnyfrjqzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqpfrgreuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqrhbrsysf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqsxqxbpxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kqxaqcfryr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kr-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krczwnigod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krdxzbxpxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kreativindia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krgrpricse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krimshdgs-76787.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krimshdgs-76787.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kripta.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200011447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krjlgkvmuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krmpuiiftl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krnsucbbqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krnwnxklkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krpfcapdof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krqatvlsvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krqdy-tkhsmc0pep6lutkaived-0ahukewj028hq9nr5a.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krstcvxzlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krttbsjjld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krujmhrdab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krwpiiwclq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krwshpqicu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krxpczkuri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krydbklzab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krypyispji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ks-fcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ks-fcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksbrxsuhca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kscitgyhtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksecdvvzbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksfomxyloo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksicikeqnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksjspkpexx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kskddjypeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksmoura.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksojhpxhch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksoktoixft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kspadsrudd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kspcrjqqcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kstlwittgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksvnrsagim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ksxowedmlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktaxv.kiduo.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktbkaqoukw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktdhqxiewv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kteyvjwdgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kthewzppdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kthswolxqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktkfafvrzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktlgzupgkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktslumlkfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktwbqvxbop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktyllstajh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktyxzbcsop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ktzhqhxenr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuaiwangba.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubaxqdvon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubfvoplpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubncwqjqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubrwqoyhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuchkuchnights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kucoin-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kucolnmyapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kudsvxqbzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kukiluyyujtk.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kulgn.weblium.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kulinersuksesinovatif.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kunadzpulr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundendienst-service.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200011507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundendienst-spk-aktivierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenprozess.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200011509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenservice-okayupdate2022.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenservice-okayupdate2022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundenzentrum-spk-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kundeservice-posten-no.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kusfdqgefh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kushmtrpih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kutntbxbwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuzuxmtnxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvbeyyffrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvcxtxezgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvfsubiejl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvhoyhpnru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvicjqbimv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvjdivoifl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvkvrhlybk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvnzrqycru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvopaqsamw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvqwlppehb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvrtmywhhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvrwggodtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvzedxxrzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwcinyrdgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwezgtojgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwhnnyqnxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwiobaelon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwlcwoomsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwmcgtjegq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwnyvfgyzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwourllgqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwoxdwenrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwqmoesspb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwqpiulaje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwszcnaxle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxjkiufjskacxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxkcdjozlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxmylbejin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxomubsara.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxqzuvsghx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxrcicarhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kxutqgaqfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyamokesib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kybersvap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyeqbyfgea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kygcvknaad.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kygcvknaad.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyjjsxtuhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyjmnhncol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyleosburn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kypuutwcnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyrlpaknkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyshutwghf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kytzetpqod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyuvodokbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzbegawiyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzcbbaqugh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzcymnzpga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzehvwklwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzfltosqxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzfzunrheh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzgkbotfkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzhezwokqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzkcbnweiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzruxyaavk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzuchetxdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kzuciafajt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l0g0n-1654546-ve.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l0gin-365.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l8kt3ed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"la.messagerie.vocale.orange.idsc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labanque-postale-9e516.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labanque-postale-9e516.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labellaempresas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"labreport.lk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacahkrukj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laccount-netflix.myvnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacvjksmzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacxeqldff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ladstktiyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ladvcjzycc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laiserhillacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laitwerjxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laiyorpdih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakeportsecretary.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakhari.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lakossagi-mkb-hu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lala-murianos-stellar-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lalkitaab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lamarbrown.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lambdaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landcredi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landskapfiles.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laporan-account.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laqghsldol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"larbbmvgnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasananucas.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laserbeauty.bestwebdevs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lastorres.tallerdigital.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lastrapidtabs.alexeyvalles1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasyaja.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latdjofqwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-haze3a7.q79jkl81.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-rice-0fc8.regan21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-sun-545c.cruisecontrol1002473358.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latinotravel.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latvia-pasts.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latvia-pasts.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laubros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchify360special.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpad-dapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpad.help"; content:"Host"; http_header; classtype:attempted-recon; sid:200011619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpad.marketmaking.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lavarinz.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200011621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laxqsojllu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laxwddqtvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"layanan-konfirakun-facebook.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"layananfacebook.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazhyguedm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazndtasmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazsatirtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lazyfixer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbancapor-lnternetlnterlbank.prestamosperu-pyme2022.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbancaporinternet-netinterbank.pe.subarubrasov.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbazgqcgpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbcpaiement-com.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbfqfyltkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbfrgtztzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbhpkczhwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbjfztclet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbjilzlxvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbkllirmzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbkmrlmlbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbliaccess.victor-marquez.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbmpeecxqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbpiaccess-validate-account.anti-bugs-kuwait.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbpiaccess.jzta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbsxdmtavs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbtvavzpup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbugwejsmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbutbbhlqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbuyqakqkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbwqoihgxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbxxfianvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lc2.shktrk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcgjevzioi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lchcrbumjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcillsfkcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lckxkeprdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lckygnfxew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcloqpoepg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lclrsrzaan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcrulnzghq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lctopzhwda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lculemglzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lcuzxppqrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldev.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200011664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldkojrtuup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldmnxobjht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldnpxvovdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldpuqqyhzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldpvuihwco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldreebemul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldudglawse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lduqjstlcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ldyevxqwfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-diablotin-rouen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-site-web-de-postlu1.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leadsbridge.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200011676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leadsbridgecontract.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200011677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leadspro.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leannahats.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lear-corps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learncricut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learnuniquemarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leassetlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leblancbrothers.leblancbrothers.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leccaagirz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lecseiipzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledermaestro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledger-fix.solutions"; content:"Host"; http_header; classtype:attempted-recon; sid:200011688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledger-freemint.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200011689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledgzxaogy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"legend-decoration.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leghlafkhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lehardrrils.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leilaopatiodetran-sp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lejztwimgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lekomosakioa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lelehdhhsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lelxqumaeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lemitwqmoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lenepweuwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leppen-kollegen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leqfhsnbou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lermuclymj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lerogfajkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lessbancodaviviendadaviplatacogreater.ebanking.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"letbeaxutv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"letstryherb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leuvttcwyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leviathandesign.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lew.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200011710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lexy.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leyzrnhaij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfbpvevsou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfcblmluos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfcqdybyqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfdhrwagat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfelixioaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lffnmgrarn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfizqmxxil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfkffoqnxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfksnalsdnlasdjl.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lflqooxoud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfnzpaicwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfosivaccz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfppjoajwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfrbbuwykr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfthpolost.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lftnxbvtbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lftofccnxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfuvqtfqfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfvhfeprxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lg-onecom-io.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgaqnbdupt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgaythkago.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgcqijzjbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgebvdifgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgervgfiwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgesnroolp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lggjpjqymb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lggytvxoff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgih.scendo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgkkxlrkmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgllmbcvyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgmsbodlup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgmtffipfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgonqrbpna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgpihyelxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgqvqcsrfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lguddjdkqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lguelbqmoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgvotxvikz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgvvuwtutj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgwukufliu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgxrtfukel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgyvxvvlua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhalwfxhlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhblszoedr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhcmqxeqod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lheihaizoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhezvkgipq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhkhbyfegw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhmbbpiqiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhputikerm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhqizcerib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhvhnchvuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhvqnjbujk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhwagsdhbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhxeieigov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhynrdnnta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liabovblpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"libicar.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200011771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"libretat8sd9415sdf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lido-staked.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lido-staked.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lidosr.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lidvprxrka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lieaiikvug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liedrtpwou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lieferung-paket-kundin.srtmw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lienquan.garenia.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifelicenseconsultants.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifenet-seimie-jp.micco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liff-gateway.lineml.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lift.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200011784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"light-office.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightcorallividvertex.luciabrllo45ij.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightequine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ligneauthenpostale.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ligneauthenpostale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liiqfytgsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lilekizkmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lilttqofop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limit-orders-v2.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limjsoaybx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limo.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limposcome.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limposcome.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linea20208725.centro200202265.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lineschlines-bccba3.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200011799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lingering-sun-f560.servicedeck.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lingering-violet-9e6f.cjoumm59.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linio.applytojob.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linio68.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linitialvasion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-vwcu.cloudns.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link.gmreg5.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200011807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linkmed.by"; content:"Host"; http_header; classtype:attempted-recon; sid:200011808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linowea.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linrwjcaad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lioktkhyvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liomortgage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lionic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lionsgate.myprintdesk.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lipnmwypzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liquidity.expert"; content:"Host"; http_header; classtype:attempted-recon; sid:200011816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-math-4e76.m-santiago3317.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-mode-47dc.85nm78ho.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-sun-c135.woodedrose.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-wood-23ca.abssupdatedlogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liujqdxejf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liusanchuan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livablefutureblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-scoremail.livescoremail.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-site.hopto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live.outlook17.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live.outlook22.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liveconnectfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livecricketworldcup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livegaliciainfo.galiciainfolive.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livegov410407092430.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livekjhgfds.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lively.marbauttulo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livesgalivia.usuarioluck.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livmlvilco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livolguard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liwgzzwxni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liznuaidfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lizziguerra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljapapqfje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljbyvvlere.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljhnadsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljjbractcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljkkakpkvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljmggwpbda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljntewljdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljpefppvgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljqqaskixq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljrrygasay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljtmbmhtqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljtsnpwyde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljxaebdogh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkansdwxz.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkbupqtxjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkeibpiats.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkkqxtfkaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lko-101454.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkobzptmun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkqjgzlc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lksteyluks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lktsqcbdoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkvvrlgdjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkxryhaudj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llgnoejatl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llhmylusii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llilll.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lljfunruso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llmiigbiko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llmjutjcjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llmpzibawk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llnuututze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lloydsbank.secure-personal-device-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llssmmjfap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llwhblnmrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llyhugx.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llzpevqqlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmaglnaryones.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200011877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmbjtbapki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmcftqiqja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmdjjoqugf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmdudsqahf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmeyntrwbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmfvzvcqip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmhblpsxsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmjboynjmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmjfcmpwge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmkjvpvild.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmnaqzvxkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmo-mscroftonline.energycarbo.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200011889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmomicronlonesmmiucor-7hdnkshdmicronlo-lologdh.jahin.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmqrmuepix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmsgwzxcrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmwzggddfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lmy.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ln5.sync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnerxvotpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnformacionlmportanteltu.panelususario.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnfosupport-decustomer.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lngjktxynx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnjoptqugf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnl201.herluy1984.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnqpliwnvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnqqmwcwya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnterbankprestamosaprobado.nobreskateboards.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnviarkyek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnvntrwmeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnzelshcxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnzxkodnhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loansidemed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lobnasasasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locahotsitua.0314646.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"local-helpdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"localso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locewmnjpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locjutdrde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locked.ftos.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200011916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locqtpznpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loedssllmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loeqpqrvsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-defikingdams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loghost.pancakesvqp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-8bi7tywpwheb7tr7twjkvrwy8grv45unjfnq4pbi9s4y3.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-93cvqtscb4t0eevdag5ojhk5zl8z9qzva3bl3l7c.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-access-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-access-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-auth7xgwk169cd02i0apk8y94pth3414vh1li9chsmleobcgr.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-auth86ku4h0cizaixm9mwyy6m0b4xz5rq1salcny0i49s0i01.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-auths0m7b9u040abs8xq6yz0eyz2qz4ejw3v1wew0lpd.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-b8sx7fjkw2sby32it82zuj6d6tjz0bepshxo2c6e2ohl6.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-iaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-icdah.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-icdah.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-lost-latam.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200011934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-share.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-share.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-doc-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-share-doc-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-file1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-file1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-power-share-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micrsoft-onedrive-signin.sansiro324wnet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-online-nab.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-review-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-review-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-tv6j39ruh5q97xo1f3u3ul67jln1yxuk5ruxnxn5njuxz.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-wallet-polygon-technology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-yahoo-for-8.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-zoommicrosoftauthenticator.blindaconsultoria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.affrm-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.cert.info.51-103-88-124.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.info.poste.decizia.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuha-bankes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuha-bunkes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuha-bunkes.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuha-bunknet-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuhabunksdm.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuhe-bunknet-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.miizuhobunksbt.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.mlznhovbunk.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200011967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.shopping.yahoo.ca51r.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.shopping.yahoo.vr8ws.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.vpasrnbc.jp.sdiqqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login1.sitelio.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginbncr1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginid-luxtrust.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginmicrosoftonlne.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginportmalbiancochile.crom.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginprim2.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginusuario45654.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginx-caixa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logistik.bpbd.boyolali.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logmedo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-microsofton.shared8.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-mtb-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon-bendigo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon-review-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon-review-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logon.microsftonline.comverdyty.pics"; content:"Host"; http_header; classtype:attempted-recon; sid:200011986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logoun.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasmagalu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasnetbrasil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasvirtualon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lokwwmacoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lomadesarrollos.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200011992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lon-der-bc1843.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200011993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lonestarcabinetrefinishers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-mouse-deaf.silentsunrise3109.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-queen-5557.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-truth-fa36.yiyahamalkers.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"longunpleasantdividend.somosdia170923.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lonoss.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookinqatar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200012002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.org.0xb646f4fa47a16309bf603fd805ecd222a5cd.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loopedcupes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lopvzekrep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loqqnd.ln123.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loqvshdytb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lost.lostincovid.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lot-lp-x.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotnltxqbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lotosarcondicionado.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loudouni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loufk.baur-scholz.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loujvaggmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loving-cartwright.5-42-199-43.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200012015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loving-sammet.62-210-168-211.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200012016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lovjtkdxpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.vp4.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpbzpjetnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpdawewbul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpdnwqxyny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpedqyrmtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpetzfcnvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpgknujiko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lphkoqeoxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpiujnxcmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lplbgwkjsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpljvcieyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lplwdlnved.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpnpktiisr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpppqglzmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpqacbuaqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lprefyffrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lps.com.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200012034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lps.cool-milo-ads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lps.hershellfrm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpxhngdtpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpxmudgmxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpxqhpfjvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpyzlpmxfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpzgofbyqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lpznnjyoah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lq3klqrg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqcsnldpwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqfdpuuzrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqfjmmmnmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqgdkdqeee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqijbkphct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqjliavgwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqkhmedkhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqmybvteuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqnmrbwdpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqnwrqgrrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqnysksmzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqpphbnpkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqqrrmyrbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqsktkrjmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqsvhcgvnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lqwlsvvuit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrdhrxukkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lreojflgpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lretrtifwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lreyllgwkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrgdpqhdzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrhsdvjksi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrhtllqofh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lroqhznihf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrpljiykil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrryfmgwnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrs-office-tax-aids-finance-gov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrtsgsksfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrtsxyoihd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrutkulcpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrvxxkhxac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrzdkejlkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrzrnwodxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrzyywxvhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdaeszzxsa.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdxztzrx.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsgdhhnyge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsicezbktu.baicaoyuan.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsjnyeyvbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsussurgpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsxlddmakj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltcqcioivs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltcrghainq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltdqujiyik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltgxsxvidi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltqpxhpcuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltrcmbqroa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltrhusvhll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltsmhalvaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltukkiclov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltvxvbpcgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltwmygcnmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltwylfjuxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltzpedruxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luatvina.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luavbybpap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luawwjxupi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lub-supply.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luciavent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucindablackwell.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucky-hill-75b5.ryoung8760.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucky-rice-73a8.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luctincourierservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucy-walker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ludo14.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luejzriupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luialvvtre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luisgc21.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luizamensal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lujstyffor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lulumalls.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lumberingcyancgibin.productsban.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lumieamaprimre.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200012116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lunacgrowstaking.trade"; content:"Host"; http_header; classtype:attempted-recon; sid:200012117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luncdex.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lutifshxto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luuneuebyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luwtgugjza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxtrustapp-login.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxtrustapp-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxury-terminal-aids-desirable.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxurywheatonapts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxyfwrhmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvcoboirqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvfwuxfihh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvjukzlwva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvjzrshiqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvlsllecdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvnhqbjwyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvqaaofjhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvqlllxzhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvqwutunqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvsjrzrukn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvsypyqfkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvtxvzsxpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lvxbvcoodg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwbsvpjzxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwbvloabiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwjispjzyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwjzsegopc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwmaylmbsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwoulgjowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwpeddmmlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwqj.qqea.cryptosex.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwstqjlcjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwwav2.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwxagidggk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwxwmuujbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwysnsflrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lwztazzmit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxadgreqld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxbnialbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxbzzcldtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdepsbmle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdhippfbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxdmfsment.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxekafimxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxjkqjmhyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxofdvqfdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxpoftnfls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxqbxxcoju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxqkyzxhri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxskdxwgam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxsnnlqrww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxweiukcuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lxwyuspzha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lydab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lydrjkycew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lydviaodnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyerwtxeoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyewyzyvzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyexjchbcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyfarutiwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyfeiohqdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyhdydfetj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyhgeoyomc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyifcrspla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyixvsgfpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lykpugjhpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lynmzvqbmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyojydhrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyqzpbxubb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyszedgfmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lytndeujay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lytrymncbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyvmaqpbaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyyjmobdjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyykttswmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzajbndhox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzbkxpnump.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzetfvlexe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzghdjacnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzkbbtcugs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzltriivkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzpjrhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzpkyjksuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzqfvzjilh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzrrslufza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzrunnxsde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzwjxmwarm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzwtskdcue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzxppmdbtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzyezdfzfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-bb1fb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m-bb1fb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.fancy-bush-cf01.marhabitas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.grande.melonwoodhomes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.help.insecurpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.licenseplates.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200012212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.protc.safty-pege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.safetyacount.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.saftypageupdate.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.still-band-a6a6.saftyalrt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.super-recipe-d45d.sombodysad.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1bzz8.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m24-montepio.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m3agence.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m3agence.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m42club.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4agence.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4agence.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4ogjd.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m9bvnr.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maalanchnayisubah.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maalcdtxqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mabdwnqolm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macro-1.accessa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macro.contactos.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macro.homers.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrocasco.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macroenlinea.verificacio19.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macromita.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrosega.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macrosobre.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macst.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madeforgaming.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madens.com.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maderaszuhaitz.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200012241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madfmzjohc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madrid-web-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maestro.my.prod.dfg152.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magaduzela.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200012245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magazinefatura.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiamgiashopee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-connect-hello.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-connectweb.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-stake.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden-w9r0solana.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiceden.2years.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicedenlogacessosegurity.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicedensafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicedenstake.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicenen-nfts.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicvelocityrating.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiiceden.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maglc-eden-solana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maglceden-marketplace.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maglcedencollection.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahendrachemicals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maheshmokalkar.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahikapur.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahirarezende.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahvlkvltg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahwsgflit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maiboxsecuredoman-att000.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maicordermyid.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-108416.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-ovhcloud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.americafirst-email0sec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.bartola.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200012273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.beauser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.clamps.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200012275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.derbyde.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200012276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.estartupchallenge-egabon.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.ims-fe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.linkbounceverify.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.lolwhoa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.loraincountyhomebuyer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.mksc.co.tz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.pdc13.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.soarcondicionado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.support-findcol.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200012285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.wakystore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail01.moncompte.f.appsuite.default.folder.ugc.umc.edu.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200012287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail1.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail1.googlle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail11.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail2.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail2.googlle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail3.goggle.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailbexnet8281.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailboxservice786.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailboxupdate23.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailenable-2bc01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailer7.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailerbt.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailinc.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailplusrolerequestedprivatemailupdates.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.d30xtanpd28maj.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.d3458ps2aene8m.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.d3789gh1ucwf1j.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.ddbu0mvfz232f.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"main.digitalatcopy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainbridging.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200012307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maincryptofixlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maindesk-userclient3.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainetissue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainetnodes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainglobaldrive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainlines.com.sa"; content:"Host"; http_header; classtype:attempted-recon; sid:200012313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetconnect.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200012314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetdapp.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetdappbot.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetrectify.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainsyncwallet-validate-io.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainwalletnetwork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majesticmeads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majhpohuhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majolashes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majtjxqhmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"make.clading.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"make.lowhood.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makeshort.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makstcs-go.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malachitecapital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malaprontaargentina.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malgritrarkna.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malibuesportiu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malloymethod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamdmuppnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamifoundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamkefu.kanuomei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manage.cisn10000062910000.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200012337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manage.hexateron.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"managearubas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mancataconsegnacard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mangpyp.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manikadv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manntetmamask-walle.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mannygonzales.wpcdn-a.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manotifvalidationsecurefr-b97681.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manuose.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mapsa.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200012347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marcaid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marcorals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"margaritakaprielyan.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200012350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marjunirtas.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"markdebrand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"market-mcsgo.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"market-vinted.2123434211.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"market.3245165121.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketingdrives.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace-axieinfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"markos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"markxiuujx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marlonmedia.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200012360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marrgiuxqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marshall.school.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"martin4dc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"martinfernando.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marymara.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascosoerd.mascescrerd.msnwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascososoerd.maseccescrerd.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosoerd.masecescrerd.rkbxko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masdhpicklo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masecoocsoersd.moasecsecsccrerd.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maseseoicsocsoersd.emsoacseueosccescrerd.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mashraqisteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masleevetunisie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masteracademy.mn"; content:"Host"; http_header; classtype:attempted-recon; sid:200012375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maswzmlvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"match.lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matchcareservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matchnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matgdlphfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mathelin-teinture-tissus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matketlaceaxelndinide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matmshgleg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matrimoniocivil.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mattys.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200012385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matzkvwjea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mauayxcrdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mavhyigkyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxchodorow.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxvaloan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maya.in.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200012391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbakxovgxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbal-bsl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbank.aktywuj-rachunek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbarquitecto.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbcljggatn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbecntnlip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbfddghx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbgxnjjsxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbhoyeyzqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbhyfgxjvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mblfumajxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbmdvvnjfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbmumyqvqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbnern.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbpbkqtroq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbqwggsgjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbrjtbznbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbtsojxgss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbubpinjbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbuqiadslu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbvadsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbxqyrcwea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mc-003.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mc.podlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200012415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mccarthyelectrical.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcconcep.cluster005.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcconivcya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcdtgmdowa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mchganistore.solofolio.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mchtyhzluj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mckfethmjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcllayojoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcmuietch-graioft-foard.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcnmcyewbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcptqdnddn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcteycoxld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcucdxzgou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcyvhdeuzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mczrdbvpyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"md-72.whb.tempwebhost.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdbkhyyzfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdczzwosrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mddlgscpos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdeafbitfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdewflmpau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdginjraau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdgpiyalgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdhplrgnrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdhuswxnza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdnunbodau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdoacbxgqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdqzheykxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdthbhjdff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdukrvspiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdwqwehlzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdzokzjgnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdzxpodz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"me-sys-design.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meadwtnyzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mealykaleidoscopicstacks.tretgdfbfd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mechinetralaya.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medelinahealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediabastitigne.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mediansivusta.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200012455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicare-gov-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicare-gov-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medistore.hk"; content:"Host"; http_header; classtype:attempted-recon; sid:200012458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medo.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200012459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medpoce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meebaalbul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeps.special-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meet.migrall.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeting-23900123090123.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megaparseonalse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megiceden.commercialmee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mehyawytiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mei.ac"; content:"Host"; http_header; classtype:attempted-recon; sid:200012468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meicadoyuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meikacrandmy.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meikacrcadmy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meikacrcadmy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meimfqqewr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-postbank-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meiqiwuizk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meixmojubq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mejoramientoen.entodoslados-contigo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mejqpqtfza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mekoqumjjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meksinue.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meldgbboqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melissaneub.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melloni.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"melzjvwlht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"member.doyajimo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"members.har.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"membersiberostartheclub.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200012487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"memelandofficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"memoriamapu.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mendami.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"menhlgpflm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"menmiqknjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mentionsba.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"menzhrhrtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mercari-cardju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertes-sharedfolder-0fficedocs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mertes-sharedfolder-0fficedocs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"merxsks.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesacanada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mescpxavqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesdoconsumidoragosto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesesemondre.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesexgunma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesixumsoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meskarsin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"message-webapp2242022-1311426938.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagecenter.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagerie-orange210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messages.travingmesgline.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messari.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200012510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messenger-web-videos0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messengerverifyaccess.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200012512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet5.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet6.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestredaobra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-appeal-center-1162636759.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-appeal-center-1162636759.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-appeal-center-1928691667.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-alert183248.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-alert185244.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-alert9012471.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-120650562.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-128691262.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-128691262.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-192591006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-192591006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-1928401.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-1928408.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-1928408.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-1928473.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-19285918.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-appeal-19285918.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-copyright1209124.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-095128212.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-102698624.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-1026986925.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-1026986925.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-112376981.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-11287691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-1291286912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-12968192.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-182657912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-182657912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-18276812.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-18276812.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-198276672.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-198276672.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-210689852.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-page-921869281.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-12897659.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-review-198609022.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-business-settings700122.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-10690692.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-11158692.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-11158692.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-1261867.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-1631687.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-1631687.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-1869177.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-appeal-2680317.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-copyright-page-12876896.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-finland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-help-extension.duia.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200012564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-122-1093681.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1221-02198691.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1296891266.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-1296891266.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-15391-717501.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-16349-14749.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-16349-14749.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-41693-19744.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-42413-11614.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-appeal-908126980.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-business-123678921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-business-12869512.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-business-12869512.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-12875621.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-page-review-1926598122.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-usersubmitform2093151.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta.verifiedbadge.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000510011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase1000530261.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase100081815111.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase100081815111.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase106524672.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacase106524672.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacaseid.1009156015961410.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaciteacn.noisy-scene-1d5c.rcvrypegsfty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaegg-defi-r8uqov6nk-megg.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafacebook100002542.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafbhelpp1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metafbhelpp1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metagames11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metagames22.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metagames66.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metahelpsupp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metahelpsupp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metalegendsnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamakwallet.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamarkkyc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-2au.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-ad.infinityfreeapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-app.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-br.jhone.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension-official.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension-web3-dapps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-extension.com.hsurge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-io-account.c1351862.ferozo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-partenaires.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-r.jhone.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-update.myvnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-security.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-verification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cash"; content:"Host"; http_header; classtype:attempted-recon; sid:200012616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200012617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.en.download.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200012618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200012619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.community-support.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.identity-verification.alacave.tg"; content:"Host"; http_header; classtype:attempted-recon; sid:200012621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.camostory.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.cinepalm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.enrichsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.festivalgrp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.gacorkan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.gramas.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.groupegerminal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.hostlanza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.idealconstructionwll.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.pizzaoclock.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.roox.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200012632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.merge.tigertiao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.security-breach.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200012634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.io.web8786.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200012635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200012636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.study"; content:"Host"; http_header; classtype:attempted-recon; sid:200012637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask004.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask2.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200012639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskaa.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskab.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskchat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskcommunity.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaske.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskfox-earncoin.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaski.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks-validate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200012650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasksafe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasksupport.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200012653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwallet.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwhois.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005801.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metapoint6005806.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metarnesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metascapegraph.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaup.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200012660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaversbox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaversedumondo.americommerce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metodoroupagratis.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metyou.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meufgts.app.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200012667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewscc09.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewwallet.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mexkzsclpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook-help-100029455684702.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook-help-100029455684702.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.com.cy"; content:"Host"; http_header; classtype:attempted-recon; sid:200012673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.lt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200012675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacubangdcoli.andreamartines.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mffhpngqlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfhjsfhimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfiglaflhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfiylbhsmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfjhptbcuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfnbebwsez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfnhhzljct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfnocqoklc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfsicoxvun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfvnlywuvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfwuypbfuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfxehzwqds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgalqssqoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgeqvukarf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgewregf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mggxardowu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mghvcghf7hbv7uhgfhv7jufreghjhg4regghuhfduhgbnfngbfghgbfgcf.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgiezvplas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgiiuuucgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgiulencqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgjwtmagxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgkkmklryw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgldbrfjmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mglibfvnlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgnbnnbkll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgnwnzugui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgpnyxemtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgtxwaejxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgudbxuots.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgvsphlbeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgvuwsnssr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgwgbasfbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgwnzpigqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mgxsco.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhbnjztzir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhcgnbwsua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhdmregkjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mheaxawraq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhnqbzgjzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhqbwhlakj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhtmwgqhig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhtzpmlpfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhukbfnizv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhwdfebugy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhwzipvcar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhylz.ficable.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miasuke.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miaungcqbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mibancocrece.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mic-cinautheticate.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"michaellannon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"michelearris.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micoedmyidjp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-doc-drive-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-doc-drive-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-doc-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-doc-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-login-drive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-file-share-locale.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-file-share-locale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-file-share-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-file-share-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microcav.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microforcemlm.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200012745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsfotoffice86572.jogengineerin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsofl.com.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200012747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft2210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftwebserver.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200012749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micuenta01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"midwesthomesinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miezihubsenk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miezuhubsenk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mifdaturen.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200012754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mihovwdfcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mihwhuhcib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miiqewkuyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mijrb.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200012758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mikrotik.smkn1klaten.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200012759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milonsquashclub.synergeelabs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milwaukee8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milyoner.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200012762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mimajzqqlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minasacapalsakam12901.nerdpol.ovh"; content:"Host"; http_header; classtype:attempted-recon; sid:200012764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miner-team.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minerlee.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingming20160152.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200012767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minha-fatura-setembro-f5-br0.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minhaclaronetresidencialapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minhafaturarener.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mining080.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mining082.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mining36.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mining79.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mining998.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minisandmum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miniurl.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200012777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mint-renga.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mint.gutterpunks.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mint.yieldguild.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintapiens.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintbot.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200012782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintnftpunks.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miranjint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirmttrjfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miropftjjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirynuwtmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misomassage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"missionshashank.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-band-34a2.bizd134.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-credit-a641.george72972323.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misyvqimef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miszihobsank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miszihubsank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mit-alert01a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mit-alert01a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mitbvrynow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mitsuphrae.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mityurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miurausa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mivqwxsghm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mixtralina-baba14.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mixuuzdwjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miymoicred02.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miymoicred02.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miymoicred02.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miziha-badk-co-jp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihbubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihi-badk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihi-badk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihi-bamk.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihu-badk.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizihubosaek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizika-bannk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuho-bask.btdia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuho-bask.ccdgi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuhobank.zzrhzp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizuka-bakk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizunhobank-servlet-logbnk0000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizunhobank-servlet-logbnk000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizunhobenk-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizunhobenkl-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizunhobenks-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizvhonbaik-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizvhonbaiks-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mizvhonbak-servlet-logbnk00000000b-do.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200012826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjatmnzdoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxixmjeydgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxiymjnyza.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1heta1dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetezmtj0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetgym3jk.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetizmtl0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetqymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetu3dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetuymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymji5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymtexdgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymufwcmlsmde5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk1mtr0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhkzmtn0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmu0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmuymzfzda.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymurly2vtymvymjiyn3ro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjcrcuvitt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjephtwtrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjfeavqgxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjfyfyhyzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjhlshqefi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjj4.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjmcuyzduk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjmzjemakf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjqwtrghit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjudsqmxja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjzxqknhqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjzzf-fqaaa-aaaad-qddma-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbhunet.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200012861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbhunet.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200012862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbhunet.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkbnetbankar.justcasinopoker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkdpipiuwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkfgfvyyfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkfgvfqmtg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkgwimjcjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhepkozap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhjotampo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkhkjiezhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkjhskcglq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkmiofecwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mksdmdhali.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mksvhkoewk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha12.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha13.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha14.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha15.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha16.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha17.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha18.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha19.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha20.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvacaptcha9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvjune22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkvredirects9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200012902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkwuvggavo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlaoyejwqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlavuszvpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlbyqzayot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlcmlhjabc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlcxypoipr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mldoqthciy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlfdulsboy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlgvcklcwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlhblvjvow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mligoeprsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mllypjmzyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlmknkxteb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlnctivqhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mloctsfnfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlothxwrrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlpkrkozzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlpvxjgsez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlpzylunqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlsridxkxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mltdkoaqtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mltpoebxko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlujonibvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlusaeukup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlvvjwjpik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlwxlfztth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlxuesolyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlyvcpwaxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlzuhobank.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mm-0-e.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mm-0-e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mm88icon.bet"; content:"Host"; http_header; classtype:attempted-recon; sid:200012934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmalgdyrkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmbjwuueuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmgfundservicesbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmgggod.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmgzojaqxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmlfqyjzax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmnmbodkzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmnmuelrta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmorpg-bonus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmpjfexydp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmqwnlmppv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmqwybittm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmskwlemxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmsnoreplysms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmsolucionesindustriales.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmtfwfhdrgkkpweitamretheuedawj.ver.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200012950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmxbeikfah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmylmyqepa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mn-finamce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mn5df6bv556.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200012954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnaxiczigj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnbbvuyt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mncziwccvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnfxusnzbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mngbkbvffi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mngrzgfntp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mniplzduzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnjaczdfck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnjsweybks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnkgracingteam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnlcrntaaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnlvyombut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnopbxbwav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnosvfnwyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnqgunvfvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnqvshpmpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnrzlfccvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mntngnjpxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnzfopheii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnzltfhohx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnzorbjfcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mo.cu.edu.eg"; content:"Host"; http_header; classtype:attempted-recon; sid:200012976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobiadvanced.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.meta-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200012978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobilestructure.09654.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moblepzisfrl.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200012980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobremerbrese.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobremerbrese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"modulodispositivoapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moelink.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mohwupphgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moja-paczka-pl-myid576xs.adisetiawan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moja-paczka-pl-myid576xs.woooo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mokopanefm.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200012988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moldthanfam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"molly-wakley.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200012990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"momtipcsji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"momwwwlcoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200012992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-easy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-easy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200012994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-espace-sfr.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200012995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monapigoogle000.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mondaysbc0455449.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monespaca.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monex.sispro.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200012999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moneyone.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200013000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monicacandussio.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200013001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monirshouvo.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monitorpopular.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monosymmetric-junct.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"montepio-acesso.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"montepio-m24.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"montessorinttc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monument.qhigh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monyeward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monzo.login-cancel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moozatech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moqingjzrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moradascorretoresdeimoveis.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-glitter-2e87.filedownjs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-limit-8833.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-river-261d.img-datings.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morvvlelsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mothlkswyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"motwiytesd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moveislojinha-app.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"movjnlprqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowsngqspl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mozpzhtuci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mozyzbkzci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mp09qu.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpcgiplzux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpdfcnqncy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpdvcqoohc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpdytcoaou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpexxngknz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpgemdlloo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mphkuwldic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpjgtyjlye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpkcxyrcpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mplas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps18-filiale89.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mps2609-filiali11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsdiycznx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaprotezionefrodi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaserviziostorno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mptyvoubmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpvkvpaymi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpwtvxryid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpwxjjujhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpxocnxcmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqcserakqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqftndxaid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqiqbkdjoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqlxqgqegl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqngctxzza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqnsmbrkyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqnvkdwktw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqonkhyyil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqrdogvkow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqrecttqjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mquyrowggm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqvdpfwzjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqxfxqankv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqxylgelac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mqzmbkdcfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mraqikdidt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrarnuxiuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrecaawning.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200013063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mreonberem.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mreonberem.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mreqimasmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrhgvfwbyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrilbdiufm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrkmzyucxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrlmbaborz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrmglldzcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrnuomvvpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrplzefknc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrwchwrjqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrxswmzqew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrzcbrxxfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrziijnfvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-0utlook-autho-0ffice.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-sharedfile-nd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-sharedfile-nd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msbhzrsnys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msc-doelsach.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200013082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mscsqcswmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msg-americafirst.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msg-biglobejp.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mshthlnbku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msirsqsxla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msjetlmgdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mskdmaeoib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mskveqqlwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msmxcdfjvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msn-security-project.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msn-security-project.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msnhsmviha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msnslive.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200013095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msofficemessagescenter-1.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200013096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msqtwkvdul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msrhsjzydt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msshsbyjbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mstd.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200013100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mstnbhsdak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mswpvgcqmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msxkdkubbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msxqzadcrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msxtikbgjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msyvmwjwio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-bank.squizofriend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-e0a64.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-e0a64.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-fhgmc.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt-verification.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtahsjzdcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtailhtl.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247line.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-smsapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-webservices.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-webservices.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb.gotdns.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200013120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbankinggg.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbbhelpcenterr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbbhelpcenterr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtblogin-mtb0.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonlinef.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonlinef.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonlinel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonlinel.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonlinservices.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbservice-help1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbservice-help1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtfuepxlkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtgbimlwfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mticncgsaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtid-5bfe0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtijlxilem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtjaeaspwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtlwiqhcqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtnyqmidzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtnzjwzecl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtonlinecare.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtonlinecare.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtqmebzlpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtqwscqbaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtrlvegaob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mttjwjlpni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtubkihcut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtverification.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtverification.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muamyplaoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mub.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mubarakimteaj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"much.migrall.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mudd.marpuasanotice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddgnjybm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-ayya.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-dawn-b613.sharepoinx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-dawn-e382.cdn-image.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-frost-ee54.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muibicvdlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mukhkelinv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muktijuso-korea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multi-coins.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multilaunch.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multiresetdao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multiwalletconnectbot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mumsturn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mumumawvjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"munloxjfru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"munndlxwiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mupebihgqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"murlidharrope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"musing-swanson.37-221-65-205.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200013175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"musytliync.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mute-fire-2a45.dealwaterpalmwe.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mutyqiscot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muwpbujqrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muxbjofere.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muxsguymfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muzih0-bapk-co-jp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muziha-badk-co-jp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muzihs-baqk-co-jp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muzihz-ba2k-co-jp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvaqpiyfge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvbwhogtfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvcas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvddcyeyau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvellolandingpage.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvetekugkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvmyakcbbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvoactiva.activacs2131.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvpwakwnga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvqlowcset.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvqrywtvmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvretotezz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvtrccfaov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvvoyeuvbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvvxeyqnnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwawquzczu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwctakjixg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwezrzbzfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwhakyhvrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwhpwaxrfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwjoqvvfcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwjsjqjwbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwkkuxaxpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwkrjvzgju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwmemlklwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwsdmbehqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwsvauehas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwtbqnhtmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwwioiplgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwxesxzhkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwxkshtnfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mx208.bank-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxainodvdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxbhtobbai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxfinuquhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxmwbzmqdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxozfbdbeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxsnzhjyze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxvdmszcyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxvtwshdmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxxbaxvqek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxyaoowchu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bellco.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bellco.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bt.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-btinternet-102073.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-104598-109327.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-105813-104979.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-resource.bwtmumo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-rser.kamsuletri.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citi-upd.bwtmumo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-citiserve-res.weroloko.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-ehtrip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-hellenic-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-hellenic-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-hellenicselta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-hellenicselta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-ltgyaqcgaqkgaqhaaqe003sclient554gws-wiz.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-o2-login.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-o2-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta-84bc2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta-ffac4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-posta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-100482-103670.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-100881-103544.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-102643-105117.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-103515-108420.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-106325-105743.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-106495-102586.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-108723-106421.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-silahkan-konfirmas-akun-anda088.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.0au.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.1au.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.au-4.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.au-5.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.heyform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.homeargentinaeminence.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myaeerejacercbook.moyjaacansceor.cxwgjq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myappbtsecurebusiness.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myattdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myattonlineupdate0.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybanko-b891fd.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybestproducts.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200013272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybetterrealty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myboxxofice.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybroadband7140002.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycb-d07e3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycb-d07e3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoencoeeb.ceosnacoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccasasoensoeob.ceosnacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneeb.ceosnaco.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myccassoeneob.ceosnaco.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myciti-res.onlineactivitieses.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myciti-serv.mytihoru.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myclpbqanf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycronoshub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycutbuddies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mycvmuzeen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydappswalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-bill-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-settlement.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-support-id.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myelta-delivery.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myelta-delivery.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myetherwallet-v5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mygov-gr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mygov-gr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myidmeicerd02.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myintegrate.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200013304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myintercommswellsu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myislavista.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscciaasoenoeeeb.ceosnacoen.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsccicasoenoeoeb.ceosnacoen.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsciaaenoeeb.ceosnoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacscicaenooeb.ceosnoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeeb.ocenacoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsieccasonoeob.ocenacoen.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsoiecccsasoenoeob.oceosnacoen.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesacccasasoenoeeb.mceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccasoeoeeb.mceoacoen.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeeb.ceosnacoen.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccoiasoensoeob.ceosnacoen.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescccsasoenaseeb.ceosnacoen.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccoioenoeob.ceoscoen.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesccsaenaeeb.ceosnoen.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescsccasasoenoeob.mceosnacoen.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccocasoenoeeb.oceosnacoen.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseaoccosasoenoeob.oceosnacoen.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaescseasooeob.mn.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoocaoenoeeb.oosnacoen.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesseaoosaoenoeob.oosnacoen.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocseooeb.myjaocseeseb.mojnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasaccoeasoeneeob.mceosnacoen.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasacoeaeneob.mceosnoen.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascccoeasoeneoob.mceosnacoen.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccoeaeneob.mceosnoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascseooeb.myejaoseeseb.mstcly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacecbook.myjacsceoc.xzvych.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacoeacoasenosob.ocsnacoen.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcacsccieasoenoscob.ceosnacoen.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasaeoeb.ca.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcasccsoasoensoaab.ceosnacoen.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcascsoaensaab.ceosnoen.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseaecoeb.caaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseeocb.caa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcaseob.c.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacccosoesosob.ceoacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaccesasoenoasob.ceosnacoen.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaceascissoenosob.eosnacoen.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceacesaenosob.ceosnoen.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaeeccasonosob.mcenacoen.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesacreaoecb.caoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaesecroab.ccoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasareaoecb.cao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceascccoiasoensosob.ceosnacoen.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceasceasoccisasoenosob.oceosnacoen.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseeccssasoenosob.mceosnacoen.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjceaseroab.cco.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeacsceooesb.moyjeasocseeseb.gzfmft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeasccseooseb.omyeesjcaoseeseb.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeacebcook.myojasccaneo.lozfev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeaececbcook.omyjascnacaeoo.orbgrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeercacecrcbook.moyjacscneocr.iazost.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeereacebrcook.myojasccaneor.zhyjec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjeeseosiaescrcseocoseebieo.socenmaseocyeueoccesoesjcaoseeseb.ytgs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjpsdkigi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjrwcmzuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacaseeob.oa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacasoesb.na.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceasceeob.oaaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsaceascoesb.naaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesecob.oaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacesocsb.naa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacseob.o.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjsacsosb.n.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaeecob.oao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacarsaoecsb.nao.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsreaobc.oo.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseacsroasbc.no.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaeecob.oaoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecacrsaoecsb.naoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscreaobc.ooaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjseaecscroasbc.noaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mykfmxtlop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mykhhorokz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mylgitedqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mymeicerd001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mymoicored01.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynab-app-personal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynavy-folder-queryculosebrbxworkersdev.culasebrbx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynavy-src-resource.routin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynzsjh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myoffice365oauth.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200013689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myoffupvvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myoivllmdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypayslip.sutherlandglobal.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200013692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypdental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypleasing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myqwkazahv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myreniwn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myretherwallet.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myshedbuilder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myshesqsdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mysoftwarebutler.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytheamsauthecent.wapgem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myts3card.cikouhfbxozic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myujadmpza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myvvxhcibr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myzjbccybs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myznaphfuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzaiyaslrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzbxlabomz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzfts.areaise.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzgqfcwecf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzhkjdwyvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mznmwmromg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzrkuzyfxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzsgjjifhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzwytgqixf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzxajpqrvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzxnvuykbfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzxtmhpfjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzydqduzxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzyizopvxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzyxejmfsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mzzckkjsng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n-holdings.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200013723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n-ver.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n0rdea1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n0rdea1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n5s4k6x3.stackpathcdn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-alert.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200013728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-www.303.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200013729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nabgtygf.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacamelaoc-kalaneaea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacion4lcosrica.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionabncrclo.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacional0998.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionalbanco077.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionbank908878.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nacionelbaan.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naciwebder.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nafguwilwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naglawgeng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nahtldkbds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naimisharanyatirtha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naivenicetriangles.anuncio22.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"najboljeuslugezavas.betterservicesforyou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nakatani-files.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nakvidsmasuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namele.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nameless-fog-03c7.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nameless-meadow-0aab.minitab4.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nameless-sound-0712.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelessajaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelesstr.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namfdgxilz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namoppkssf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nano.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nanoversehqnft.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nanvhvgroe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naoutamateep.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"napffx5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"narabeautyusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nascimentoadvg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nasdaqet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nastssfuln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nat1onalbr.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nationalbank.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nattynetworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naturhouse.sk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nauory.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nausithoe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naver-8f56b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naver-8f56b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi17.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi20.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi26.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi30.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi41.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi47.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi51.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi52.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navlslavzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navyfederal-e760.navyfederal432.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayanielectronics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayfvvgsug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naygqsvmcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayiiqtkgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbauajfbnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbbkwejohz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbfhhsdbxcdas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbhdwpbrfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbiwjnehdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbkmvcuvem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nblfkvvdsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbmegadtac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbomejtvft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbpjcbiogi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbqajcryrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbraomloxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbsdruiapy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbsoxogemf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbwcdrzuzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbxfallrlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nby1um.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbzxirbzkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncagvdokag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncarkwugwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncbvysfadfdaxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncccvicfib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nccqm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncfaruaobp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncfyjvesza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nchbrggbuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncityjrwbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncivnwfjzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncjezngjhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncjtlhtrss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncoafd53cfe55c1019f08c3c010c89f8918efd53cfe55c1019f08c3c010c89f.ncoa-org.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncqlpxozzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncqqioswog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncrforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nctovizclb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvejkbjpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvjhgfgert.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvsreyujy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncylnlyzhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczcbnqnlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczfpcqufh.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczlitwdbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nczmvgzqub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndahubjgzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndbtxfevbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nddwurskrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndeflawtechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndfiump.bai-gei.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndfydlydqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndnkyxylne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndpvwygegi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndrcfksorh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndrkmfnzft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndsgxcdqef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nduuekhtzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndwoatigqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndwphxmqzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndwyzypugv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"near-wallet-login-hom.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nearwalletgithome.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neat-shade-pantydraco.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"necsdbsrtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"necudneflirty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nedbankqa.flowblocks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"need.manthem.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neeshaplastic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nefacbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"negociosensuramerica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neixol.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nejqujepnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nelmmtjwav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nelvebkzok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nemonbremesere.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nemonbremesere.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nephytcsha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neptune-ecli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neqquchsud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerestera.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neriluvdoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerjkznqxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nesgvjmuon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nesiriwfqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nesuvicxjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"net-flix-payment.thecornercoffeeshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflix.infuerd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixbilling.com-payments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixguiltless-guide.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200013876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixparty.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netstation.netapul2kmails5wxopoa2ryonu0to.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netstation.owalive2netscop2apluso3mail4popstm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netverify.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netwalletauth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360007.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"network360007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkthursday009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neutralappsync.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neutsebnle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neuxtvckwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neuzvcefqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neversencommun.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nevkkuzrwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.friendsquito.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.joss-home.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"new.laposadadelch.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newadoberound0008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newhomepoocoin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newhopemakassar.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newlink-popup-smart.biglink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200013912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newlistclub131.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newmont.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newtoningenieria.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nexoinmobiliario.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200013917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nextnurzjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neyblqchtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neyuorofhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nezglaqipo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfbxhrbwti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfghtjbvxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfigkluusp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfizklatug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nflbheclee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nflsmuxmsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfmohcgmsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfrcvihmvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfrsdk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftbuterin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftio.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200013932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftmint.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200013933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftonline.gift"; content:"Host"; http_header; classtype:attempted-recon; sid:200013934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftracking.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftshark.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfuupoepiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfvxztxmiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfwgucgjex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfwqbaoaal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfwtjiqhxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfzzfirusy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng1038321ulso2hod9u3tpesjq0idk7l1oocjlj2142otoq4qbctva8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng1ep2e8ibuashobfbu37r30pk22cjm9sr6c2ueil089n22pia5cc6o.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngaxpjgqsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngbhbfbiua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngcae.fandoon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngdfsaothc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngedngudgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngffgfggbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nghjbgfalt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngjqalsrfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngjzgjypjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngkkilnfurniture.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nglvowefpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngmwsjxaah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngpvjhrdwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngsmartrp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngthyfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngwrbrxent.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngwsnecpgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngxpkjynkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngxzriifcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhattinsteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhdsufarfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhgxhsaiaollshkd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhgzqraaiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhjvncylkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhkfsujjak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhnwhfkakb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhqcxfxyzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhqmwdioub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhrfyoggcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhs-order-pcrtestkit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsapply-covid-pass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsfdhyubzsxyu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhumrccdpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhusuvvwqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhuybwybms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhylgevymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhymkxptxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhysafodgkho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhzlfacxxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niagarapower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niapxrwyph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nibi.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200013986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nice-lalande.5-255-101-246.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200013987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicephoto.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicepriceoffice.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nickeiodeonnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicola-jane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoleaction.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoledruschnewitz.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoqthehs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicxshsyuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nieuwpoortbe.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niftyoblongautomatedinformationsystem.login879.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niftypertal.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nighkclick.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nigvbetrty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nihkuvcgtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nijdocojcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nijzamqacs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nikkofarmer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ninjasquadnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nippagroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niquuzkepi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nirotfcqhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nirtunquba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nitffebskt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nitro.neeve.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nitro2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nituopedrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nivudqlqqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niywcjwiec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nizotchauffage.bilty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200014016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njcngcuoym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njfjzkjeal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njgenarzxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njoomzdlnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njpxfbhiwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njssknxodq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njucfkddzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njuocvfzuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njvmrgvdmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njxfrwupod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njzjtvmzob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkanyisosecurity.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200014028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkbajqownx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkbcpqknph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkbdlfyisx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkboelrfts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkcefmntdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkcgawdnnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkffgdegsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkhpledkfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nklmhqorri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nklzzodaip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkmoqjjqix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkpwvtdhbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nksdcqsihp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nktmkyjwno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nktwefjmva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkwbpdkodm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkwoojmtep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nkxbagvutg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nldnzzpqem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nldtjnbvtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nliagwcfyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlicafjyrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlkknyjpmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlmzswsxkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlnihuumfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nloxlzxfnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlpkxjecqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlqdycilpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrhbeoyso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrlbepoyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrwhwtxis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrxh5.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlstidzuov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nltntyxbkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlufhwogjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlvfkyspqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlwsxbshlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmcdwozqof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmcutdiabf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmdqw.oeanymufmdhoy169.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmeylaxywo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmfhdjfrhfjg-103164.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200014070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmftowdkuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmglgghrjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmgxyiavmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmikyxaktt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmiqijndfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmkvyzkayp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmofheehvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmoufzxlhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmpznbcalk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmqkywihyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmqutqcwrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmrefrigeration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmsdomtyxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmtcqgdjmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmtpfjyrhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmulzqrxyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmwwsdwvte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmwywyemlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmxnvgfeqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmxrlclfyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmycyssgiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmzdlwolfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmzptebbfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nna.asiaconnect.bdren.net.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnahrbxgqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nndwswsmxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnedapgigw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nngatakrqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nngybkvcot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnhdsnbphv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nniuolcfee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnmguzamrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnnhmybrmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnqrervotk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnqyxhyznr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnrqvqhpxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnstyvlxzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nntydkmalb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nntzsyhbdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnvdeoksce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnvrqdvsil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnyetherwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nnyimjsiwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"no-reply-meta-10010110.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"no-reply-meta-10010110.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noawyzhkol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noderemedy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noigcnhuix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noiseless-summer-softball.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-arts.03vd9e23.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-brook-6cbf.pros-wear-06.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-shadow-493c.wastrer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noiuxmadmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nokoamemvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nokrusrwqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noksdgbuof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noloajohsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nolprqjsdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nominexauth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nominexauth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nonprofitnetworkofindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nopftkkhvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordaelogg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordaelogg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"normalangstonrealestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"normbryane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"norstoneinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"northfacesklep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nosposte458d.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nossas-solucoes-agora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noswzuqjch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notife.help.institutepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notification-fb.secure-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notificationservicefrances.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notificationservicefrances.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-me.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200014148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12869281.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-page-appeal-12962-06889.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noumedremese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nourayatravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nouveaufonds-leboncoin.18-130-39-138.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nouvellefonctionnalitorange.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"novaitau.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"novonexcarluize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nowccclnsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nowsupport-3ece3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nowsupport-3ece3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nowzzgzsfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noxtechblob00082310.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nozkmadynk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"np.bb0n.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200014163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npbxnqqhgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npcfokmsmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npfpdttceq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npnneitryi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npnwpgcxdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npreilgirw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nprgrjlmel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nprgrjlmel.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npsgueiuit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npthvvcips.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nptiibgvfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nptugnxtra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npturpcigz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npuevkrggu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"npwnlgbebt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqarhudxbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqbftpzlbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqehezoizj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqeklzfvwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqelwwqfvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqeymzkxnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqhnbhgqsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqhppvxkoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqkgsjgqyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqmvlzcqkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqqpzsxnui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqqzghsvop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqsqydcewi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nqvbpcwunr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrbynlyfjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nredantgst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrekctnckg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrixxuoxxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrjfewmwql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrnhfhzuqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrocaopkqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nroedreamcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrospsczlp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrsgmsvnfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrtgsrnuoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrtxdgnucx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nrwnydmkfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nscijzzspb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsegv.penning.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsfsrahbww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsfwkuhqjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsgboktaex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsiiwgihdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsk.russamogon.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsncrneiuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nspaz.edu.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200014214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nspjlanaws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nspojmahcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsqrpgmzjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nt.embluemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-aa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-ac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-c.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-cc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-cq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-gov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-jp.hnkhbz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-jp.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-re.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200014228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nta-u.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntabprydks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntago-jp.nistkom.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.czfengchi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.ehxsrai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.gridcreative.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.hcrkrz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.pdxsazf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.ruilibath.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.tifrrqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.tljkcnk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.txluij.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.wrdmvsa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntagoi-jp.wyjluyg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaguoi-jp.aesfera.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaguoi-jp.hbslcmu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.4tv9m0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.6fb6wq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.9gsczn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.9is0q2.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.9y8v6u.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.a5x2xo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntaigon-jp.a9wm1q.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntamfgwrgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntburqizkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntcorp.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntiuexgalh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntkmgekted.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntkugghsli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntkyafkofw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntlejuxerp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntlgghlkic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntnfpnhvmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntttmorfvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntvkdvczhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntwks009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ntxojrnywq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nudesyncronizekey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuenzhfozc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevo-tuya-2.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuyya14.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevosestudi324.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuhcrlnjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"numberoneburger.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200014275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuncorehits.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nunes-boys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuotpfgunt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuovo.formanagenow.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200014279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nupsezignu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nupwniolro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuriero.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nurtnjhqcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuvemdafaturasbrasileira.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvapagvenq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvbcfatda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvchersag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvcjhhrjyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvcvsgetj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvdehbstaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvdzsysz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvfncdnivk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvgubyagul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvidia1651665403.zendesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvidiastore.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvigvvjclo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvjnwzwpwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvkvceuysx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvmkzqhpgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvmpbyraoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvpkdppgna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvqauunrww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvuwhesphu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvxhfswr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvyscndtcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvyuaibyem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwcafomgck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwcxzbuvjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwdpnksjvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwdqknynum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwnmhqzphe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwnnfmbwpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwohosxomr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwoihigpch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwopagwtzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwqenuqrtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwrghatt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwrhfzaqrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwrqljxzto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwsqtwnuyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwss419.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwsviywnjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwtwsrbbdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwuameiycy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwudyrupff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwzsyuslyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwztzdbgtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxbczjdlbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxdhnvtcfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxdjgwyfkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxdvoounff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxehhtccht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxgiesciil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxgsrfczgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxhcjisc-njkjkjd-jcjkdkjd-9m8wf.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxhzil.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxltzsobly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxlwccmhdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxqntnrkeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxt12500.nextadmin.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxtochkbkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxuwdolsfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxwdajjohz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxwrezoels.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxzfvaxgul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyazniwsvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nybidavvdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nybmohxlxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nycydkquxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyefzuqhqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyestriasztas.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyhobmueen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyiksaulekel.66ghz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyknbajbxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nymo.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nynecqamgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyolrassil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyptvwxfqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyqsgxrmza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyscfco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysestarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysethkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyunybofun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyvlgkznhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyvngfbzth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxecagasr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxkkkjjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxupobzqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyxxxxyree.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzdhwtwzab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzffxqizwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzfhjzmsbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzkimooyqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzosmwjwkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzpyctjgdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzpyiguihz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzquvmmxtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzrmitqfsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzufswpork.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzumuxljoy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzvqjsigxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzvuiaauxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nzwpslcejc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o2-billing.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o93dd.live3932.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oabpzgfcch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oadpuqqhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaebmvqbpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaerjlxjpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oahwzgkbly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oahyjrxwao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaisiz.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaklitnxnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oakouupxzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oalcpiolrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oanafbkajfla.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oanqbumigu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaoeheklmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oaos.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oapcnlgkzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oasisworkz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oawbpakqqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oazvmlkyeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obbzzksocf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obczqgsaxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obdfsmvwwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obdzrlnkxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obejdgj20.d208ai8leta6q5.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obeojilczs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objective-blackwell.139-177-182-62.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objectstorage.ca-toronto-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objectstorage.eu-paris-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obpvdyefbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obpxfqqfeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obqphggisj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obsiawstdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obuvfsfxov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obvwefjklb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obwipjjyin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"obxmbxudcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"occcicoop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oceansideinvestors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocfckohswe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocgsqfetkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ochtbpavue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ochzvtukoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocioturismogalicia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ockkcruugv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oclcssncls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocmoasenismsfg.lmnaseloin.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocnewyork.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocoolkqilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocretyhujq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocrzqfuquq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocsclnbflp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocsvsfumvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"octubre.expertgracecastillo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"octvzeajmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocvjbbywdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocwumxkytp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocyjkpxoir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odbrbidytj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odbzfdzypl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-bonus-a725.wastemen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-breadd9a.wed8spk8.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-field-9e1d.microsft-docs-foecisayant.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-lake-a237.hvac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odffwrxuoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odfydhowfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odjjtrljhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odjljnfsuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odkwbmlhjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odnlbltsnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odpkcucnlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odpxfjsuyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odqwarihpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odsnobhkjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odszpknloy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odurwxsyso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odwtchcprr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odxzsjxjan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odyxmkriwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odzgnjtjbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odzyriojkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oea4t2.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeamvhuhrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oebeuhhntn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oebhkuobru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oebkijsqav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeijpcadop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oelkwlcnvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oemybejnde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oenwtvjseq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeofjztdiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oepcibuxli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeplnucqfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oepmortgage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oewsxysmrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeyynhnaqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oeztmgndma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofaazojgni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofaufqjkzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofbiaohbuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofbitrpirf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofbvxhovee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofekdpnemb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oferta-230.order3235.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200014487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oferta-51.order8216.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200014488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofertamagazin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofertasdomesmagazineluiza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofewijjjzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offfc4503032.sitebuilder.name.tools"; content:"Host"; http_header; classtype:attempted-recon; sid:200014492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-365-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-365-security-notifications.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-invauth13425.zeknotarzo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office.ways-status.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office03039200323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office03039200323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office18bd41c4e27d01ca654ef485200a641cc381795dd3ee389f34900c690.softmail2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office24ba15ff9906029c852bb400dea2990b1b8aca4e1b643202d4ec7c0c8.softmais.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office27f227de102c9d63ac9f975899a7eb8727f227de102c9d63ac9f97589.egeary.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office2ba26c936161df9a60ce20211f793266211c4e3be87fdae87bf4d3c4b.softmail3.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office346422eff3a37052e27dceac15b15a1c346422eff3a37052e27dceac1.commercejp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-com-online.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-owa6878.microsoftpublisher.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365appsfax.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365dumc0med5cibcugnc7dkvci2qbmrzo72wkguova62vqkkcib.softmail1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office39283c79b6d239c952b821624b0e6a26c3383c79b6d239c952b821624.emailnow2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office517561fc83f1fcba0c373e6a3194623e517561fc83f1fcba0c373e6a3.wheelinghomeless.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office56b37d9abc629a95a353b4753bea37a356b37d9abc629a95a353b4753.acceptance.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office791eb7f904b4cf42b73b8b6eb3bd1023791eb7f904b4cf42b73b8b6eb.tynanlaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office7be5d0cc7597185ea2b07c5d67ace2647be5d0cc7597185ea2b07c5d6.mailmicrosoft.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office80f8a649b49eef411c04a82b3e39b85b80f8a649b49eef411c04aa8fd.onedriveoffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office949abb2585772ab51a8ad332f13989dcd5d5bb2585772ab51a8ad332f.abcsenderz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office95352e9ccf1b1b0027b683de66e337bb95352e9ccf1b1b0027b683de6.mcrosoftfilezs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeaf3038133032eec1406a08677e4e3152af3038133032eec1406a08677.mojylaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officealertasygrupo.grupoonlin.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officebd96618918cac08e309d8b2e5a3d6d25bd96618918cac08e309d8b2e5.dreamsgentlemenclub.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officec53d59b9a7fa68faa8ac3e6fed0f7678c53d59b9a7fa68faa8ac3e6fe.cathykonnik.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedept365cerifi4763.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive204b23499ee682480a9d4fb5592dcf30c7b323499ee682480a9d.ondreivsds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive671d943c66d43639ff504f6e8603b0d3637b943c66d43639ff50.offices365files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive6860908c937775e0f58fe179754804126860908c937775e0f58f.onedrivesgf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrivef7848b1089c0b94ba05f0ee7a32b53dbf7848b1089c0b94ba05f.drivecheckmails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officee421a8bc35722f5aa4bbc277404bf8bee421a8bc35722f5aa4bbc2774.officemicrosofte421a8bc35722f5aa4bbc277404bf8bee421a8bc35722f5a.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeee.bubbleapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive0449c492c4fd1eb2f9a68932d4b8e7ff0449c492c4fd1eb2f.mcrosoftfilez6879.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive25ffed98fda6dd6c8d5c80834463490d25ffed98fda6dd6c8.microsoftz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive634e3a53e73e0036f30a04bf224dcf85634e3a53e73e0036f.microsoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive7259cb18c1bc44b8e9b415dd251dd4ce7259cb18c1bc44b8e.micromails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive7be1bfb0486de510b18632cad5938a287be1bfb0486de510b.paulboffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive896f8a9115240dd777b605c925eca22c381c8a9115240dd77.softoffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive9cf9dd481ca05e2e7a7837abcf593ef6e37abcf593ef6e37a.mcrosoftfiles.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedriveaf5f5e5ad0794773bb4296155c18d99caf5f5e5ad0794773b.softofficex.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedriveb7affd86aa6565d724aefba4b8dbea52b7affd86aa6565d72.officewi.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivec34109e8baa4f981ff836aec31d86510c34109e8baa4f981f.softshare.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivedb4a74607068611f61cd159e966ae78d53c319380101349d0.softmicromail1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrives2e38ea393a11eb94bd1bc533816b19052e38ea3b19052e38.filemicrosoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonline.manifo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeoutlookfdaa672a942961604a8cd3b0cb5247c2fdaa672a942961604a.abcsender.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officequarantineemails.elementor.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200014541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offices160a0dfe952dc58d52babb813089b049160a0dfe952dc58d52babb81.officemails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officesc739fc24499a54ef81e2243e9d60c97fc739fc24499a54ef81e2243e.filesesecures.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officework.dns2.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200014544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"official1inch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officialliker.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offlprkcqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offyourplate.my.idaptive.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofgcdrpalg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofgfqzzdza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oficialofiice.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofidpozuqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofiimbiljl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofjjihgkkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oflpdkidwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofnqywwiax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofocptiqhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofqfukquge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofquyrt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofrlxnilul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofssamofya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofutplinfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofvbglhrjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofvbttlzop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofwbqndvyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofworabmpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofyaiotqun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofzrvadffx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofzyn3.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogasbnzfce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogccgrruxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogdraashag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogfsltaspy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oggtlmwkkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oghslsqmik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogktmtipie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oglfidgcvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogltpsblqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogmbcwvhvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogmjuyjdst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogmldgcjun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogniwwivzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ognlgamgtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ognodopknh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogrvxkpgos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogsnabrmoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oguozjqink.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogzjresuuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ogzjxmuohb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohcloudshare-webmail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohekjinclw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohenjluwvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohexntnqkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohhcxvlhod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohiqsrkgmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohity.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohjknfskls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohlcvymnvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohqaqqcmdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohvjcmagfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohvmfzdpdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohw.tf"; content:"Host"; http_header; classtype:attempted-recon; sid:200014602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikbccuuyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikmmmn998.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikmmmn998.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oikmnh.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiobktqwya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oioxenlwwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiqpvxrvqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oirymfzqkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oisfdjsiwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiswwnwsjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oitcxshltv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oiuiksfjag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oivwzmqjqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oixgiejo8596.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oixvhbswyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oizhrjiehf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojeymahweo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojfbwcftbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojisytakbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojkejbbgzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojktgghxqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojogtletod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojoootwfta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojpdrhipma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojrbupbdty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojswzjweij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojsxgaqidc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojsxztdbhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojvrvpythd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojwbkfjdef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojyrhvsrft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojywffndpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ojzpkdztcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okbtcgtocu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okcphotoboothrental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okejsgvkaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okgpqrrgot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okltjquhip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okokyakqrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okpwtu.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oktiyejacg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okwinxqgvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okyjgpiude.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okyuwqkqgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzbubdtla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzvvrvbuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzxgpagwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olabert.playcode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olaezuvfsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olami-009-bo.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olathrough.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olbxvadqzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old-firefly-ec6a.fefefefef.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old-lab-7887.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oldmyskptx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olefycmtwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olgalab.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olgeutavds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olhbrkgcbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oliair.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200014663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olirecords.mixture.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olivhtune.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olivius.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oljmxzlwxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ollccoplzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ollhvhhmjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olnvvlryul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olpreamw.iklom.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olufwwlari.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oluwarantinmialafia.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olwaowbbve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olwtjtvjic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-market.975211.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pl-xhp.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.365psd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ahosan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.aiing.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.anunt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.bigal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.buyma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cai6.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.caitech.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cenga.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.conans.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.cxdswz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dakuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dantri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dazhikeji.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.derot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.dinle.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.eehx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.erogu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.erolin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.facebo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.garati.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.ggdev.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.gkdh.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.glzav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.iceba2.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.isunxu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.jiayi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.jufri.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.klonky.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.kodepos.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.letroc.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.maytao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.meijidh1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.mksale.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.mtsheba.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.necm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.neocyte.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.njdaily.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.nuoan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.nutrifit.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.owia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.pdigit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.piaofa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.povd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.prathers.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.qt314.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rajvic.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.rashid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.refpaneb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.remiel.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.riming.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.sabwap.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.sajam.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.snapnue.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.stellas.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.thusly.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.tukule.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.valtrex247.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.vmouret.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.wompus.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.yeori.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.yuvati.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-shop.65958451.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-ua.run-pay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olxizaghxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"om-9473s.9237-28a.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omahashutters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omareturnian.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omawpwcxaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omcqzbitgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omdjggeqqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omdwigygtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omgshots.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200014750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omgwmicxpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omhcdmvwbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omicronhotel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omlmdsjnll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ommwfoomub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omniafricashop.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200014756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omqqqvmwpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omrgroupitaliagiambelli.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omrgroupitaliagiambelli.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omtgnwkjwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omvfozzikh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omvgldgyrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omvxgumljj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omwsgbgmgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omxamodyip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omzuaqvzjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ondequiseres.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200014767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ondqsyoxzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ondrive-58feb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"one-store.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200014770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-98234.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-file0110.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-files-93169.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-proxy.daofengql.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-public.fengwind.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-shared-geor.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-shared.zineadiet.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-thesharedfiles.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.12075354539642.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.ama2on.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.augustus-xue.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.dearkai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.dpot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.jennitai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.potatoyang246.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.prprv.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.stanl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive1-live.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive1xp8kg.12009.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrivee5.joejoe5.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrivefile.yanzhihao.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onee-a0488.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onelogin1secure.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onemade.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200014794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oneone-19cd8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onescanner.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ongocbwtzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ongrvolods.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onige.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200014799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onipvoshec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onkcjuqocv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-acount-validat-e.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-amfc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-amfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-detma.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-outlook-serv.bijafo78361843.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-pdf-portal.visura.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-promerica-utts.123567831.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-versand-mk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.marcointernetpe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineaccesspoint3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinecdn4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk1.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinedesk7.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinemanage10.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinenewbankbcp.viiabcp.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineoffice365-owa5418.microsoftcertifications2022.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineportal-spkcheck.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200014819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineprofile.misecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinesbanking18279.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineservice-mtb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineservice-mtb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineshowerheads.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam3.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam4.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineteam6.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineuspostme-ba3b8e.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200014829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlyprovinciarg434.infling.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlystorebutik.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onnebrzfoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onojxafjpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onrpvlpqbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onstre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ontbhevwvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onutlummtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onvcrmoyvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onvfraqumm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onyjqwuoxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooawhlhgjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oobchgthrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oocgfcsngv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oodvwluhbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oogvitxafo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oohswfcvwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oojvpyzbwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oombcyphpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oonmerdcpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oooalkhafc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oookocortz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oooqpydozb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooqbjbkltz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooqsgozcff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooqumyghuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ootuqpgycg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oouwritbef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oovzmjofgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oowppzhsen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooxznrxevq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"op-auth1-lk28h.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opa.md"; content:"Host"; http_header; classtype:attempted-recon; sid:200014862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdateringsrvc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdfrance-dot-sharepointexcel-362410.uk.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdtyndfvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-nft-airdrop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-support.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-tools.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea.org.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseaspps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensee-marketplace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensee.nu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensid.bandungkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200014876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"operationiaod892a.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"operatore-mps1-filiale1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opfnhjspjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ophnqpeshu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ophyqyhkdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opnsea-oo-login.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opolaqramb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oposicionesgaite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opretretopoptk.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oprzjzrmtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opttlqzdtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optus-support.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optydistribution.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200014889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opxfxwfsbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opxqsghybs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opygnmyhgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqeejmqiuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqffrludsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqgbidvxya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqgvpiergt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqhepyeskc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqidocarvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqizdctewp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjlpsnlvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjvwfnvgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqjzrvcbkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqpfdlvngn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqpqazxify.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqsglsoxlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqwgxqlbii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oqyxhwkaeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orabote.name"; content:"Host"; http_header; classtype:attempted-recon; sid:200014908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba111.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba117.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba145.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba158.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba161.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangba180.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-security.cloud.coreoz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-thunder-1962.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-vocale.ukit.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.iobeya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.sphinxonline.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.windagrande78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange1554878.upgates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange1554878.upgates.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200014922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangebank.mailerpage.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangebells.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangess.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oranjempsnspeo.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orauxczclv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orber.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orbqbmizxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orckqzxrdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orckziwxeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orcube-bf0cf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"order9236.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orderlyvioletdimensions.rastmoonlight.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orgjchexvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orhmpthkgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"origin.axieinfinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"originmirrors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orjnqddwrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orllpmmess.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormail.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormantencs112.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormklhopjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ornbmbppuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orpromed.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orqywmtqnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orrwisjdmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ortuspropertysolutions.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200014948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orxoxewymg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orytb.vailice.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orzfmqskxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orzjahghko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osakbsigzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osbwiflzgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oshwfekget.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oskcbsttdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osmosis-cosmos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osnktjxxmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ospinazamora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osqdygqemg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osryuccvbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osssrrfeic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ostenergie.osteoenergie.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200014963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osufagydvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"osxrsazxgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otatceensz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otbpkxeebm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otehqifohm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otepkvmgom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otherress.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otherress.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"othersplc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"othersplc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otkzbyqsex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otlhersilde.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otmfrwoswx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otmsaxoagg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otmspixsrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otnerslde.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200014979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otoayhyboz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto-h229.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto3452.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otqvwdqdox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ots-services.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otshfabpgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otshovqnmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ottsfltjnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otulajtmat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otxcpcydtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ou1ook-maile-1d28.queri.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouazxrwjcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouczdbimev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oujysfoatt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oukerbevfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oumihgebvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oundzmupxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ounyftostc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oupragjuvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouqnfqysqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouqsntclki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouresoujaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ourkitmrhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outdpwuuzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlok.formaloo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook-107217.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook-online-serv.xapori52911831.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook1541489.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlooksotf_cln_mailcln.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlooksupportteamsr.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outubromagico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouvgfaiyar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovagqsvktt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovbhsvasyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovcatrcdtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"overdueshyarchives.060300.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oveuywncnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovfwwnsghv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovgowdvlkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-cl0ud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-dfh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-19f4a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhmlgwmaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovifrwcbwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovpqnpgmld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovqnwndxgu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovvvqwkztr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovycloqhbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovyhytgvjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovymlvxiyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ow0493040343.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ow9993954545.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owaieiqiwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owanyyyggz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owaweb3-6-5.mailauthorize.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owdbwdbabs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owhimbrhgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owkraaeqtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owlxyhfrpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owlya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owmjqcarot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owvkztelvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owvnkyxhdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owwnzkvzut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owxmwjblro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owzegktpor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxbtki.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxdhosjasr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxgdfpsfzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxglfzcalr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxissdvycs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxlavyziia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxmathrpkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxpgjzeupl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxpizsjjgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxuurvcqxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxuvwtsamg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxvfdsdtso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxwzcpffpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxzksljmvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oycgwryhml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyhliofsfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyjxtyzrwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylccakybn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylpaeoxza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oylzksgwcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oymbiygavs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyonhcirzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyoshopbuisness.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oytbgsfrff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oytgdgugyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyusgvhpeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyutwexcfgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyvevrpsli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyxpsqsvfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyywfwjqxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozboya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozgdjojzxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozgdsvswco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozhduhjhdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozihpwpryl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozjlsitcmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozjwubyiii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozkdtjdjtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozlgnvfpxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozmftdcrsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oznwydgqjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozo.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozon-zakaz.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200015093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozon.id4884.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200015094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozpofnlixf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozqseckknc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozqwwtvech.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozrzjgkzkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozwupmpasn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozzbxaxszy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozzhtnvnbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozzvsfbnak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p0lygon-php.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p1.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200015104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p4age4countact1vitydiseb3l.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p9o.floki201675.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pa.ncakeswap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pabtmojvaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pabztoejdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacificcapital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pacificpasta.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200015111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200015112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.bg"; content:"Host"; http_header; classtype:attempted-recon; sid:200015113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"packageusps.cloudns.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200015115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paeaivkciv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pafjppjfoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pafxbi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pafxozople.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagamenti.assistenzastaff.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagamenti.staffassistenza.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagasidtitysacountidnfomtionsideityts.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-129876912.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-129876912.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-appeal-form-192186921.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-recovery-identity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page.appmobilepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page2-improveaccess.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page3eprot3ectionsservic3s3curity.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page5comunit1apdatesacoiun1277365.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagecenterservice.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageclient-userdesk1.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation618576.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageconfirmation727011.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelp-center2022.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200015135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelpid.1005645783485693456.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagehelpsupport6516159851.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageidentity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagerecoveryidentity2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-help-center.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-marvelous-project.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-protection-update-2022.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-protetions-updates2022.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages.secure-accts.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagescrfinationsidenetityacounts.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesecureinformationsactisltysistem.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesreconfirmationsidentitysecure.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesrestricted7u149349328businessrecovery.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagosfreetuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pahjqzrxjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pahlnzqaow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pahsgcmbnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paiementboncoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"painel.odara.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200015154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paipai-bannk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paipai-bannk.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200015156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pakersi-pl.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200015157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paket-postch.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200015158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pakfexunbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paldy.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200015160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"palmguy.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200015161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pamkinbxud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pampacomunicaciones.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200015163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancaake.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200015164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancaekeswap.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200015165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-sand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-swapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake.v3-financ.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake100x.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200015169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake7wop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakemobile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeslap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeslap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesswaps.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200015174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesswaps.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvvap.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200015176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvwap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200015177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesw.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswa-p.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap-airdrop.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200015180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap-home.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.diamondhandsnetwork.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.himotechglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200015187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.uk.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.yahoosites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapairdrop.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200015190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapefinance.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswappers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswappshop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapsupport.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancokeswope.finance.mechadda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pandamoniumplaycentre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panelweb-4cae2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pantekkalisakitkepalaku.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panzax.bienonline.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"papernet-sales.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallel.minting-live.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallelmetaspace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallelnewblockchain.ssbancogalicia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parametroverifica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parasindustries.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-reschedule-gb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-reschedule-gb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-schedule-date.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel-schedule-date.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parentdaily.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parfumieftin.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"park.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parkercreativegroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parkstatesbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"particulares-es-bd5e31.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200015218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"particulier-espaceboncoin.18-130-39-138.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"partleiy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"partnerupwithcj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pascgcigew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pasgeasidtyisaycomunitytasyasda.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pasnnztapv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passionfruit4576261.brizy.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-cell-40f5.updatedlogmylogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-recipe-8acc.0z7nntak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-shadow-0c07.q0gb8c1s.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-starp.9u94voh3.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patricecarolrainer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paukiyfgiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paverguide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pavifashion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pavivity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxblkfuyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxcxjjler.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxfuili.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-cp.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-mains.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200015239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-up.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful-vendor.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200015241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful.com.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200015242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful53.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxiful.epizy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-apple-id.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payee-review.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payee-review.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymentnotificationnow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymydoctor.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200015249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payozavkfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200015251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypal.secure-verimail-usersecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay-bank.hjvter.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200015253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.con7uq.jaojpoa.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200015254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.hf93yx.jaofzre.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.oy6qg7.dsxsoiurtd.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200015256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.xicdkv.fsfroqiorx.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypay.ye4fd8.dsxsoiurtd.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200015258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payu-home-pl-f9b62.ittiqadniaga.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pazulxpufq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbaayhnwwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbihfdblzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbkjppjgju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbnlofsveg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pboeqobepx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pboodlyrmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbshcxztfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbsqkixavn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbtexazloz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbvndrwnnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pbxtnnpmnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcbtlscpim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pccyjtllme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcdtvhifia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcfhuaezoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcfiiuboua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcfxiakcrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcgeiantrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pckbdmnvqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcliwblgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcosniwfml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcqrwkdzzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcrrulcfba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcrzbjmjob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsdyjhexd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsystemscelaya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcuevubpla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcvmnsxvyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcvqmyngly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcxpmwdswb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcydizdbjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pczajrykas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdaffceylp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdajejnxym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pddgkwudln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdeaf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-cloud-document.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-shared-cloud.project-deec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-sharefile-doc.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf.file-documents.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-24042.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-55b22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument-55b22.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument2-794bf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument2-794bf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfdocument200.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfsecured.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdgcnrxbgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdipwkqgbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdkarozzul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdkkajlogk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdojzugitc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdouznwkyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdqjtvblxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdrwazvfcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peaceful-haibt.45-155-165-9.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peachyspuffs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pearlhvgvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pearlinsurancebroker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peclmjpibu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pederopeder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pegupfoofk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pehtjyjefx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pejnndknmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pekao.myapp-account.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200015325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pekrkasrvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pellegrinaggiomariano.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200015327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pembatalan-pemblookirann.webnode.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pembatalan-penangguhan.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pembatalanbloockiraccountsid.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemblokiran-akun2023.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemblokiran-fb.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemblokirannfb1.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemblokiranresmi2348.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pembloockiranaccounttid.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemfxatica.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemoowtljl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pemulihanresmiakau9.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pending-10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pending-10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pengembalian-dana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"penguncianfb.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"penzvdxwvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pepperelmillcampusllc.securevdr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pepsicomerchshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pepsiconcertdrinks.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200015346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peptate.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peremilia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectenergy.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"performancelocal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan-fb81.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan-loginalterss67.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan-pemblokiran-2002.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan08.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatanfacebo0k.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatanpemblokiran11.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perituza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pernimt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perochek.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200015360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perolamineira.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perosonasjes.posingresla.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"persianmy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personal-santander-verify.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personaonline.server1.trinchera.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personasportal.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perspectiveperceptionhypnosis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"petrappriverd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"petrichor-uae.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"petsraisingpeople.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peubqajojx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peugthgblb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pewdgagsls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peweetools.truly-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pewxtgvnub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peyjtkxdzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peyzoenawg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfalgzihth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfdkqmrbur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfefanwilz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfivxrgxqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfiyrwgmap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjczntemz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjykejodq.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfkwpyxuvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pflkjzqfej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfmchvzicb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfqbyebljs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfrxmsailk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfzjpsqzre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgalobbvif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgdswaxm-jp.wpthzht.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200015392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pge1441955791048helpp.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200015393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgeesnhyxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgfsbulyxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pghduyeqha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgiwfpkvkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgmilkmdrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgninzptmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgobjhbcgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgogtjdsqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgqbe.myselfy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgqswhsduq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgrbuvenra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgsinfotech.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgwuhfeuil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgygatsknn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pgytgvhzcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phamjmnzjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-wallett.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantoms-web.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantomupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantomwalett.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pharmanet.org.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200015414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phayklkmhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phbxpdrypj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phckbmmqfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phcpzkwgyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phiaykjetn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phijrsjdfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"philipqz.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"philomenasraven.earth"; content:"Host"; http_header; classtype:attempted-recon; sid:200015422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phjepmntrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phjrzyjvmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phocsvdksd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"photographyimproved.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php-green-parrot-kousama713428.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php-purple-elephant-support430327.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php-web-server.9524125.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"php5ymysql.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phreshphoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phsjibczdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phthalocyaninepigement.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phthalocyaninepigement.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phx888.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phzbqqowko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piarngttmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pickjflbed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"picnic.industries"; content:"Host"; http_header; classtype:attempted-recon; sid:200015439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pict-product.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200015440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"picturebookconnoisseur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pid1-aaenoeabj.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pideaqui-peru.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200015443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pidetuprestamo.stage.analyzenbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pidetuprestamoonlinebcp.aerobiology.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200015445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pidxkknvtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pifhwmxeua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piiuujpapy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piizczyhcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piizuacgfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pikay13.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pikuukmifn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pilawtyfkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinballfinder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinjhcjskf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinkmaids.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200015456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinksale-finance.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pintgftfye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pioeqixtaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pioneerplanephasekamla.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pioocion.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pipe302414607-ypu6n69k.systeme.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pipekomjmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piratebirds.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pirywkujoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piscinaveronza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pishraw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pisi1488228gmailcom.dmses.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200015468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pisosfarias-0-polygonon-0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piurwywdbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piuwgcezjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pivpxaztwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pixoffjphq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pixofive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piztpjjmpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjaqgrujvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjcsifopok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjepimrilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjfcfcplsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjkhwfcigp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjkueqmshj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjlanguagelearningassistance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjlvelgoyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjnbcdefse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjpfaclhjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjqvdehbzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjrmucslln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjsetrkgir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjtififiai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pjvpyrphox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkarjkxpfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkbzlqirrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkckvnwfzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkcscsqlac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkexlppjie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkgmpanqxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkhcwzdkex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkkfehfwnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkkimkbamz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkllunnlpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pknklxuubq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkobussiness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkqkhjddeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkqqfijosi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pksjvaytdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkstacrnlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkt-bpsdm.kalbarprov.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pktagkfimw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pktzvcpvsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkvhbnpefe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkyljbzoin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkyopchghe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkypunjqfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pkzqgutjaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pl.inpost-zakupdoz.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200015515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pl3jsy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plac1d.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"placeboook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-flower-e3c0.phantasm0147.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-frost-6851.p54drdar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-mouse-6094.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain.selalusalome.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plamtpwgbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"planetdallas.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"planslife.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plastic-upbeat-trollius.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasticaindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"platdujour.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plaustrs.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"play-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playful-beijinho-647fff.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plbietwcpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plcdmpntxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plclpxscbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pleasingsaltyblog.sinpup.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plenkmqzmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plentyofishdating.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plg-polygon-tecnology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plggozpslh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pljghlycli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plnvththsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plnzfowwzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ploodbokdy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plpntceumy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plpycdvwrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plqeoihgfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pltoactsif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plu.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200015548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pluge.loglet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plwvesscgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plyfpsazdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmadkxmtqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmb.akamigasbalongan.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmceskwdsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmcndktmnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmgpbsapvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmkbjpuwse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmkemjwfem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmluwltrzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmndimlpqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmoasesorias.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200015561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmqknnnpcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmqurublkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmroids.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200015564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmrplmyhcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmsclyxrga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pmsddxsnyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnalorxjuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnayhstcay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnbjpsqfle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnbvlbtxck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnezmmfznr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnftgwvujr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pngplsjpuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnhjbbveik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjynyfmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnkfgkwmbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnnqoboyxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnqczfykza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnrcxdewtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnvdzwgxlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poarexsioe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poc-rewards-program-c2dfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poconoshotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poczta-polska.e-kei.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200015586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"podljqnajt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pogkhwiozb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pogmotru.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poilpsqplr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pojfvcjbnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokajca.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poknmuqxvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokqcmqrpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poligrafiapias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polished-frost-5c8b.pearwormermone.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polished-unit-0189.maddison-383.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polishedvcxvb.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polite-taiyaki-696f3a.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkabridge-giveaway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkadot.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200015601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkastarters.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polllygonn-waallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollyggon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollygonnwalletconect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poloskairto.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.id4249854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-allegro.merchant1981999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-dpd-sdkk1.vmouret.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-dpd.information970347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-dpd.merchant1981999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-lnpost.information970347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-poczlta.merchant9600973.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-vinted-hjso21.cpzj8.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon---technology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-onlline.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-wallet0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonconnecttwallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonexs05.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonixls-antonio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonixls-leandra.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonjan.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonmac.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxls-raylson.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxlss-antonio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polyqon-technology-connect-wallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ponqjviaoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooadueyoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-app.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-appm.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pooccoin-axpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiln-apap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiln-aplp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiln-apwp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiln-aqpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiln-aupp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-app-com.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-app-plataform-connect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-appu.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-bsc-charts-token-connect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-connect-app-tokens.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-connect-plataform.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-new.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoingearapp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoiniswaptokens.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-appc.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-appv.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-aptp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-aqpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-swayp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-swkap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoinz-swnap.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocojin-apyp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocojin-arpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocojin-azpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocolin-aepp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocolin-anpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocolin-apbp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocolin-apmp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocolin-avpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoln.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200015661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poofsdyhpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poogoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poogoin.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poojcoin-appa.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poolcoin-aapp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poolcoin-alpp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poolcoin-apyp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poopmximxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poouqvrnoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"populardclud.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"popupsubsmart.streamlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200015672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poqoqgfrnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poraskjdasfs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porodjzqtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porrtalperson.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portail-client-sfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal.revenue.sercie.m2xa0.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200015678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalappseguro.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalclicknegocios.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200015680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaldosfamosos.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200015681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portale.pp.info.it.clickmobile-ml.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaledigitale.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalejo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalempsweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalesecurloginclients.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalesicurezzablocco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalkanal.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalonlinebanca.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalpayexito.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalporinternetdesdecasasolicitudesinmediatas.mxmointernetvelocidad.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalsitopanade.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltransaccionalseguropagos.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltranstuyl.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltuyacupo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltuyapay0.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaluyaexito.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaluytareaandfdhrth.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porwbybgsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"position-exachange-naps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posminterurugiay.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-ch.sameday.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post.send-deliver.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200015704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-6a485.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-6a485.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-6cdf5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-6cdf5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-slovenia.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posta-slovenia.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postairequextstsrvicescliento03i.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postal-sessionbach0025.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postal-sessionbach0025.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postalebankid-bcf177.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200015714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postaleinstallation.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postaltrasacionalexito.lovestoblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch.checking-ssl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch.checks-ssl.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch.safety-order.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch9192.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posteinfo.anedevrdc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posteitps-online.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posterscale.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200015724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postmailer.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postoffice-co-za.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postoffice-co-za.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postswissch.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postu-up.vizvaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postu-up.x24hr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posxpbxpvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"potaltyapairinmg.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"potnwacmut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"potwierdzenie.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200015734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poufaigifj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"power-share-login-doc-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powerlineindustriesinc.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powersafeenergia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poyqay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poytuuefky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pp-90214950.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200015741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppaghnfgzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppastnveev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppfafoundation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppldpuagkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppljbghkce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppljpdbtwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pplrsawqcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppmxtmbxbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppnsxuuodi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppohnkndyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppqcemutbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppvneqpnsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppvuyzckct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pq0vv4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqabssscif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqbmqwmgjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqdoulncii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqhrjcvdcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqklweptyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqmmetzvue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqmmvviurx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqnkakqcwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqsoqrtals.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqswjiqglh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqswxzgksa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqucefhbrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqvvtsrmxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqyyehrceo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqzpxaeuvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqzthvbhap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pr-innenausbau.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pr7k4s.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pra-voce-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"practical-shirley.141-98-6-164.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"practical-swirles.45-33-10-134.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prairieharbor.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prcfzbpejp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prcjxet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prdggtefvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preciosideales.degustar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preg.marketingvici.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prejmwhpyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"premiaprestamosibk.noustecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200015784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"premiumpethouse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preoajpmdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preppingconfidence.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestamoporin3a-betacontigobcp.weissbaseball.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestamos-bcpbetaporweb-peenlinea.bicentennialbeer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestamos-interbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preta.controint1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prevenstar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preventivefire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-content-projet.sugar-voicee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-document.tortesabun.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-download-file.dating-optimize.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-download-project.voice-chatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-files.project-deec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-folder.people-media.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-ups-mail.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-ups-mail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview.mailerlite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prfqncwdti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prgebyvgmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prhfzkjtqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"priceless-heisenberg.198-58-102-175.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primeone.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primocircolomarsciano.edu.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200015808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prince.ps"; content:"Host"; http_header; classtype:attempted-recon; sid:200015809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"print0ffce.rec6110.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"printingon5th.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prioridadbancariainforma.secryyy56.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"priscillariddley.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privacidad.politica.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privacy-point-50000245875896309.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privaitstrong-b45a85.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200015816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatbank.cardpay.onl"; content:"Host"; http_header; classtype:attempted-recon; sid:200015817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"private-pdf.iteroageme.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatkunden.post.de.meine.13-49-41-52.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200015819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"priyankasandokar1606.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procedi-area-clienti-web.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200015821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procedi-ora2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"processbox.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procreditecuatorial.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procservautomatizacion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prod-2ht7dc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"production.shiny-tree-e80c.clane.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"productosyserviciosalternos.marioasesor.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"professhealthproducts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"profiimobiliare.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200015830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"programadotz.com.br.admin-mcas-df.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200015831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"programowanietowyzwanie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200015832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-cloud-folder.mature-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-cloud-shared.oauthh-conf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-folder.chat-securee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-list.doceungeyymeu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-preview-shared.grand-oauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11-b2412.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11-b2412.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11a-8cd2d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11a-8cd2d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11c-95a40.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11c-95a40.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project11d-2a638.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12a-1b5f4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12c-1ea70.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12c-1ea70.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12e-83d13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project12e-83d13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project13b-575b9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project14c-39bfb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-b49de.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-b49de.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project1d-adb1a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project1d-e2a39.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project1d-e2a39.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project3d-8252b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project4-37fc8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project4-37fc8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project8a-f3596.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project8a-f3596.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed771.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed771.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed811.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project9c-ed811.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectfiles.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectjiotower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectjiotower.govermentdot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectwebmainnets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prokmdenuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prolaptop.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promericainformavalide.promer23.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promericasv.v2screengoes.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prometheus.asia-pancakeswap.dysnix.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promgalicia.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200015875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promo.mycorporate-rewards.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promocionib.machunion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pronagas.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200015878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proof.mint-live.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proojectttt.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propair.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200015881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propercyanwearable.url2132.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proposal-projects.procesrpguvins.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosxsiuser.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-4d56vca.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200015885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect.bartonlewisfamily.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protected-message2022-1311615844.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-46454898944615-fb.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200015888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-sfr.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200015889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protocolddpp2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proton-update-me.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proud-unit-1b37.weatherest.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proud-wave-c1db.izu0em45.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"providenetwork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"provinciab.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prozess-kundenweiterleitung.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prrepovfgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prrxdsgliz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prtqpflmjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prueflowbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pruvecfymu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prv-swisis-psotal-chf.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200015902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prvdzxfnpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prxpknpbgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prymqkdoxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"przddqrzet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psbpjirlha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde44532.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psfgalicia.psfgalicia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psgeneration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psharp.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200015911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pskcmpcidg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psmbcatztr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psplgghdmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pssuafqosa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pstnhcuizg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pstucrjfqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pswrvrcrgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psxcxgyhun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psxiyqnamf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pszkclddjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psztkholun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptaosbxhyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptbrphrblo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptbwawpzih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptcjnmxekq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pteloqtbwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptfyfbjzpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptgjehvond.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pthocakbiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pthrdmjkku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptlstqgmua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptlzhxnsig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptpjiwuzto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptschxjwbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptszrwqvtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptuyanewaumentui008t6.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptvfjuakqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptvptxaozv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptxx.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptzmnnwrfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptzugjyvwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puadre.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200015943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubg-event.arcanepbg.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200015944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubg-mob.monthly4end.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200015945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubgbattlegrounds104.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200015946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubgmidassbuyy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubgmobileoffical1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publicdefinetwork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publish-p43452-e180057.adobeaemcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pudgyipenguins.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200015951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pudyenafbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pufvjccrvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puhpzftiho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pujabhandar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pulnzgagae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pumachipim.bsitc-apps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pumaperspectives.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pureanchoreddemo.dia26092023.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purple-da6462.qqu4qswu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purple-morning-d15d.beewatchsea.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200015961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purpose-built-impro.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purpttlgmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pusatbahasa.uinjkt.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"push-spk.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"push-spk.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pustaka.smkn1klaten.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puvtytvvbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puyegwgjut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvasqqabnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvbpslgypp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvdviwfttd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvedyqhzod.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200015973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvezkebskh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvgavtrndv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvgxagipih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvipuxaxlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvlowgvskd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvnsqlxrzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvqffimryd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvrgfjcowf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvvpvi.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvvsbzukhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvwkjgmjrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvzmbisevz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvzrzjnndh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pvzzmxxnin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwbbssnlaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwdmyrmduy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwfdzmtgyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwgqcfbrpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwhhtlkvpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwhrhijjtz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwievnwski.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwiuumhwlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwjftbwqkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwjrgnyuer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwktmbmrpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwmqtdchun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwokfvlczc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwssthczuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwudcrpqxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwuxriinth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwxibqfzbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwzqslfsnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxcoplvkyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxddkydidi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxdyjzkahx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxgqnapzsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxhjaezdxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxhudtegra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxhwwvfntu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxhzwpbzoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxjwbfqmnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxnhefizkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxpnvezpja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxpswyobhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxquesst.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxthjyxoei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxtiqiivbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxtszyefqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxwrlrmsrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxzamppein.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pxzvtxuryu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pybwygksyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pydjfhnxxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyebrrmgdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pygpyiaool.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyhkkmnice.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyhxpobsrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pymddxjjyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pymugknruo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pynopvadjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pypfnwcded.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pypoqascot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyqjbcqmug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyuskidizc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pyybcnjcdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzdfnoglzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzdviivacl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzgjvokzpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzhbfncxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzhrjzfhvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzlwbwmwgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzmqdualjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pznbabitau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzrqkkgugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzvgrmaedr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzwxkdzygj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzxuyhjujt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzylvudfav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pzznqvzkwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"q22-3a1661187218506-ei33krqd777-tkhsmc0pep.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qahdsxalol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qahtoipaxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaiezltgex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qalrrabpac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qappterowh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaqeflipbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaslnwfntw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qasnfiagkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qasuhbhkon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatar2022.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200016063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatar2022.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200016064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qataraccomdation2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qathllyach.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qatjagvyup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaucrriqor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qauwmnczoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qavtfkawml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qawlkvfusd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qaxtavfvpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qb8uv3irpb3yrg42k.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbbcorfqjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbbruawlee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbfovvmtnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbftntoajw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbifzfjfpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbikozdfcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbjqtadglx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbjublhdfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbkmltnwkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qblwhwapoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbnobmrydm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbocd.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qboqcpazmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbrcsnopmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbrhmvhakw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbrluqsqjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbszbucyqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbuhbkiehn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbvlrqvvrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbwjyccdan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbxoqajhgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbzmnmlzat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbzwexoddq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcbjhrkaoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcblxmmdyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcbppjtmpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcclttzdfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qccqpmdtcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcdngqpmnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qceewasaaw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcermqolcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcfvreznso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcfyqgojho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcgaoabxmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qchcljhgdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qckjpoykqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qckvpcwohl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qclhcganfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qclusiyjll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcmvhzwihu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcnminween.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcqdbcyset.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcrxumteoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcrzbsmfdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qctocidhkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qctprtnxel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcunrtddqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcvizcslsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qcxlslzfaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qczurvltcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdajscegna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdbiejelmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qddqzrcttz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qddstiosza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdesbqbpzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdnevufxhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdttydmtzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdxtjrlvrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdyldxnide.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qdzioopasq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeaahlsyam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qeaemmgnpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qebmvabmwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qefwbbrmfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qejzjydrcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qernrsllex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qetxpxznwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qewifilusc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qexfcpaufc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qexkerexvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qezzvepyje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfaglcl-wwt-4.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200016145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfakchjxoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfcljnjpff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfepjgtiro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfigqzjwad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfiphnbzhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfmnc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfpgffjvkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfpyrhlufr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfrzpghtjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfsjyqmixl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfspwogpyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfsuwaeruk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfuhegnvum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfuyqjxdsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfviiyhrhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfvlttipqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfwqcidida.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qfwvhtwydl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgblchohkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgcjftfbko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgdsgzeraqfqdfc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgejugoqgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgiolgyncd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgpgbipeqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgpvlpgtxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgrguisnza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgstjxmelu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qguyoaopvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgvjicwarg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgxmomegwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgxtlzxaee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhbqopdkty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhiasvmuyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhiooirxfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhiuzkhbzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhiwwshpnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhj39hfxqftr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhmojwclgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhntbfpelz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhqgrqezzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhqylodeex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhrndmhrdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhspcdtkju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhuoalxyex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhuxuanwio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhvcpuijal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhvxkkfphe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhwfdgzqdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhwglgfcay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qi0d0k.vectorguitars.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qickcyukcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qidolpfwzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qievhiuqoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qihgxyldjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiinupxhep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiiyrssodk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qinyhdlnxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qioxthzjsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qioznahbzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qip3oi4hv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiqolbwiaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qivsbzvqlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiwhnaysrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiy4jkqgkd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200016209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qiyhrbnkrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qizjyjgmfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qizkxdcutc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjbbfrerbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjfvrqrneg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjghtydzkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjhbslhqhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjkociodsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjmlyvrmcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjndoughjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjnqzxwwnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjoqngdxbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjrjqzahsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjrtiajhom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjtslzqyda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjuopvvgfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qjvjchsmsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkapqattws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkazuwpklr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkbeozhlye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkclrvprww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkeqvybxzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkfjlklmix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkflafuhbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkflhqk4h3l.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200016234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkmpnuwcdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkobotqvlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkodmekpav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qksccljtqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkshvbjlkb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkttafenph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkusgltupi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkvcyjpmyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkwxobacmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkxchkllye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qkxkyhdiiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlaiacqskg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qldqyxwltk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qleepaztdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlgwhovnjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qljrkpwfbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qljzabdtfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlkpzjszvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlmrqkgyfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlndoncshi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlpfgunama.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlpfmuvekv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlpyywaupr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlqoohvglb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlrizgituk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlsbwelkbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlsciqtkry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlshxtmnfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qltgdrzkfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlucvtxify.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlyomtyfni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlziikpcxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmadhgtgrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmblsyzfws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmcpnrwmvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmdfpuehpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmfnymxmmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmfzirhyqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmgfoysxsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmgfysdabfdn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmjjraysfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmjvklwlym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmlifkuvao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmonwcsqgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmoqtlrfbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmrppuaeby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmtrdjhcoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmulpodewa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmwcriaksm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmwwlermzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmyqjpgpcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qmyy6g81shs5mawrnsxfst7benzb8diw7baw2khhduuo7t.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnbrtaqrpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnbvhcckyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qneeunriup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qneggtvnof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnelmtodrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qneukxwzqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnghzgwaam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnitlvylnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnkmauzwne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnndjlbzjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnnocm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnnozm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnomc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnomz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnpczavycw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnqksnnhmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnrpacqkiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnrrfiddcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnsubmypoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnvjxqwnsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qnxbazktix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoaapvdywy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qobbcpcqdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qobvzcayls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qodlexegsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qodmwbtcgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoeln.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200016314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qogeokzzdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qogooziokf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoi53ioofdg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qokfiswfnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qolixgtrgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qolnlavvbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qomilkwojp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qonvmkgbun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qonxphchfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qonygmbegx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qooiulrqvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qopio4l321hd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200016326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qopmvipatd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qossitjruq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qp1ctm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpbguajasl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpbjjaynqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpcczqutwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpimtdpybl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpkjzfpdib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpkzsmjvdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qplgcjuzyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpofkiquiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpoi43jhlqc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpovtugprf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpovtugprf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qprmlnyjhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpuoajqotr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpuwobtotp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qpwhzryiqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqbhrwinrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqbvbpshgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqcfeabdbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqcgcfdkcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqdwrlcaeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqjvbpjubi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqltfbvlrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqlznwiiwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqqesrjhtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qquzsgfwdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqvnbsmkgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqyinidrli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqzdkzarxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qqzqomvwoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qratabmqid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrcthnfnzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrdalyoztx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrfngzbjgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrgclguovf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrgdbmzprd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrhiwcjifg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrhtjnuyct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrjtylhhzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrnywtbnpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrogcluiuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qroztbknel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrpljjqsie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrqcpcqnxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrqielweph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrr.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200016374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrubumbxyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrvalvpbse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrvkzjdbsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrwhorcfgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qrxanocudn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qryskhgcoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsdaxvktvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsdefgg.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsdhjfgxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsecddhmxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsevumyngz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsfheisaqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsh74pekkv5e8.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsihlqzppo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsirnobqrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsizngcgju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qslfqjwmvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsmmwsrcom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsnytydlds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsrrowrofk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsvk6n.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qswsvfpfnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsxbeecrlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtedfxqqwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtfjiyysfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtfqkzrpra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtgxbrbtqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qthholjwgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtidhtaial.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtkvuhzjoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtmknajirs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtpo34lkhqvcl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtpudewiai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtsnhcfhhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtvaotedfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtvxyjqydn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qtzmwjlaza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quafreefirevip.gearena.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200016412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quantumworkspace34.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200016413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-2542022app-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-mes2742022-1311564033.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine26042022mic-1311531473.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine27042022web-1311564033.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qube.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quchfgkmsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qucxvnwlde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qudjjrzlti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qudsovdayn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"queirozpublicidad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"querice.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"questionableironcladcomment.345678865.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quhehrzrep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickbite-protocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickfixtest1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-block-e399.westmoons.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-glade-0366.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiet-meadow.8av37ve6.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiouyuuu76.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quiouyuuu76.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quizzical-mcnulty.185-194-219-163.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200016435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qujnkuxqgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote123430.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote123430.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote432109.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote444309.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote45255530.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quote5555553.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quoter4439000.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quoter4439000.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quoterrw534.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qupbperaft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quqwhcgzux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qutrlkrbgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qutxvkjepl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quuieyrt53654.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quuootew32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quuootew32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quvxasjfsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quykayohki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvbwwkeplb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvczjbspvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvfrnaqdga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvgwlsnogf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvhyc.nttion.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvpvfcavww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvuctsifsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvvpwkrxcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qvzggfmjji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwcbpyuftg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwcccjkb4j4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwccpfpiyb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwccpfpiyb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwcnfts.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwdufpbano.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qweqchzsrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwgdfkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwktaramhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwkygnhqgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwlevtlzds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwoicvj23b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwoiocj2l3k.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200016476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwrefdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwwbvkykkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwxguawwpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwxtvdczsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxdyihiiid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxgbbxetxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxhigyjbno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxijwzuonu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxizicakro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxjbdyyrhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxkbonmzlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxlmkebecr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxmnrxzgmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxosytfioy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxprhzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxuwljkhtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxvmnnxtap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxyxyinxsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyaqzktrbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qycxouctlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyedzdhxyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyeheakuam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyixsewhlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qylr.scendo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qymioipjgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qynzkqutcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyovpfimkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyphpgoezh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qypwdtqyhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyqupdamkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qysbhbukas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyseunyluf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qytdmhqxvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyulerssbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyuvtluxye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyvuxtqrfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qyyzelscnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzemseyumm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzfppvvpaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzheyiptil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzhgxjlted.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzihqupfca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzlcfxgadc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzliboenzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qznyzszefc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzpluvsmqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzsbbputxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzsgdfdsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzuwnwgqlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzvgnwfznz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzvnwlcgeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzzcjzaqpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qzzwurhpij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r26ifh.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r2mzim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r2o3as.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r7d29i.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r8vfisf7v703na8fmxcq.s3.eu-north-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r9ogn4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200016535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ra.kiech.correarealtygroup.cl.#.ahr0chm6ly9iywzrcmvpzjnkzdrwegz0n3hzeg83bxnqedv3axdwamq0zgdmbmxrnxh1advnamezzxdudxrnnghnbs5pcgzzlm5mdhn0b3jhz2uubgluay8jywjvbmlsbgfacmhyaw50zxjuyxrpb25hbc5jb20=3d"; content:"Host"; http_header; classtype:attempted-recon; sid:200016536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raaijlarld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rabbithole.mirror.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rachelholz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"racing-expo.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200016540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-adminpanel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-adminpanel.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-specsadminteam.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rack-specsadminteam.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackenfordlabs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackspcemondy009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radhekrishnapackersmovers.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200016554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radhikamd.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radiant-pegasus-ec0145.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radward.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatcsrnocn.rakaseeoaseroour.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekoatnocn.rakaseeoour.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotncsron.rakaseoouasero.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raekotnon.rakaseoou.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raeolkkdod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rafzmcnwom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raiutkvlkaen3u1.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200016773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rajasosialmedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaecsroocu.raekoetnaseroonr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakasaeoocu.raekoetnonr.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseocsrou.raekotnonasero.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200016940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakaseoou.raekotnon.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakibmotors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuitan-japan-jp.boswese.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuitan-japan-jp.leacocke.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-cards-japan.thinks-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-confirme.pauios-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-japan-confirme.japan-happylifes.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-japan.happys-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-japan.paayos-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuiten-japan.paayosi-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200016984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakumajp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-jp.bbbbpb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200016986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-jp.douhaosoft.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200016987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-jp.hned.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200016988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-jp.pinl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200016989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten.reuandhkus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten.shcikusaun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten.xonreungfop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakutencardco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakutenco.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200016994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakutenxkahqn1.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200016995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakvten-bask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ralgerylqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ralgjsbgop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ramanjitsingh.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200016999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ranboomerch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"randle-main.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.ioaier.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.naisio.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.naisioe.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.naisiro.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.neisoe.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.oiecsi.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.oieose.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.pdoieu.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.peiti.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.poeidu.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.poujse.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.shoier.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rao.xcioea.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakcsrorcou.rakoeasaserouern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raoseakorcou.rakoeasuern.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekocsrrou.rakoasuenasero.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raosekorou.rakoasuen.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rapid-disk-caef.anyrag8021015.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarebli.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarestable.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raribille.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekoatcnocn.rakaseeeeooaur.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotcsrncon.rakaseooaseroueea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasekotncon.rakaseooueea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasha.dillevery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rashvand.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasacsrecoocu.raekoeaseroteenoanr.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasaecoocu.raekoeteenoanr.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.jianhudong.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200017517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskasecsrocou.raekotnoaseroneea.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200017556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raskaseocou.raekotnoneea.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasoseakcorcou.rakoeaeesuaern.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekcsrocrou.rakoasuaseroeeena.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rasosekocrou.rakoasueeena.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200017782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-king-4ed0.settingspaqesapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-water-dcc2.beanwoodnode.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ratqggwqil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rauchenbergerlenggries.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ravffbdotd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rawtifnong.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayalpha.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raycargo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydium-alpha.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydiumapp.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydiumprotocol.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayhanbusiness.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200017794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raykfcczik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"razcpufynr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbaizskats.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbavjfdzvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbcaqrpgqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbcmontgomery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfcu-bank9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbfuaccjho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbgogjbaez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbjkaagkjalk.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200017807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbkbuqsrxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbmqqbiyhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbtnr.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200017810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbuqjokdtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbytzcxhxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbyyvjwhkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbzmsqrvlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rc-mt82374fhcbyugfgveiyfv3t23485234.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcbcxblmvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rccwbwcgzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcgcghcvhvhvvyt.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcgnawbipc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcimxjqvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcjtcbfbsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcldwlbzwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rclrkllwkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcmkwnxprm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcmrkrfolz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcnzjjeeaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcocajwgdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcrlfnciys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcrtoisgia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcsvzumimd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube000009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111112.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111112.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111114.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcube111114.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcubebit.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcuidentity.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200017848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sftyacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sprt.acn-cnfrm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcwkxdlqwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcycnmukbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rczbzsvnvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rczlozstyd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdagzzsrmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdbeckymbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdehnvilta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdeotqloke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdghldoegn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdgwqigzjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdhtire.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdjkmjoguvhmokjkufjcvcfxresdfxcvxfdsredxcvxfdsexfcvdzxfch.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdkftvxtoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdmytqwnow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdogjgpldt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdopqvbstr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdoqxszkqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdqycpbeur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdrsnyodzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdtfmzhowf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdvtzthrfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdvvzjfavb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdysazrkej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re-redirection-acc-id923872635122.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re2ions.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re2ions.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re7d89uevhusah8c.lavzewwclkpiipe-uiguiui-yutriug.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivate-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivationoline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactiwqsdadsd3a.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200017883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"real.tj"; content:"Host"; http_header; classtype:attempted-recon; sid:200017884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realorigin.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reaqnlenqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reasktren-baek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rebeccasokol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recomfirmpagesecurity.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"record-cloud-file.product-list.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recovery-fb.secure-acct.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recovery-protection2022.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recphelppsupportaccounnttt.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recreatorme.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rectificationweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recuperaciondecuenta-12b0.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"red-cloud-e2f8.ls7lqn9c7536.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redaosda9s8r235889asd.sigue.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200017899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redbysfrgroupebox.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rede-gerenciadorcx-multiassistencia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeem-microsoft-code.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200017902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-parcel-au.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-parcel-au.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery-elta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery-elta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery-inquiry-package.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redelivery.gbroyaltracking.20-214-234-184.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redesign.randolphunlimited.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rediractionid547012016089540218057.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redirection-b836d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redtailfriday0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redtailfriday0004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"refund.tax.wvnid.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200017914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regencord.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regenerations.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regentoption.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regi-uspso.0ulnjj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200017918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regi-uspso.0zgj5s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200017919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regionalezeknozoyda.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.animonda.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200017921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.templejoy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglemenetationsg01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglement-boncoin-securise.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg05.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reglementationsg05.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regoin5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regoin5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regt.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200017929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regularizaautorepuve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reikiwithasha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reinforcementdetail.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200017932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rejahqyrfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rekemlcuhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relaxed-robinson.45-155-168-199.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200017935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relevantmenacingembeds.daviplataverifi.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200017936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancedigitalwholesalers.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200017937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancejiojob.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliancesmm.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200017939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relinefinancer.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200017940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"relloans.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200017941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reltdjpymm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remboursement-impots-gouv.espace-controle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rememondrese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remixethereumcompiler.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remondremse.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remototarget.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remzicakar.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renataassad.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200017949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renew-licence-transport-nznznznz.evfarma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renga.free-premints.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renner-fatura-boleto.ct37556.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200017952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renouv-en-ligne.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renouvellement-aide.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renouvellements-carte.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200017955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rentapb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reoifbhk340v.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200017957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reoxmletza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rep320x000239x9eer099400cer01x.vene.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200017959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repcoe5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repetasas4docioa3eadasd4ka.mire.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200017961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repl-mess.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repristinoaccessoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reptile-world-nft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repugoogne.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repugoogne.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reqlboidfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"request.br.ironmountain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"requestcomfirmyahoos-stupendous-site.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200017969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"requestuspusppepostsrvicesid03912.oznemedya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"requireloginaccesspage-53rd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rerwzrddci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"res-va.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resarqarvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resgateacumulado.dynv6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resolve686445tdt877te3.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resolvendo-registro-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resolverjhfvhwdbwdg.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200017978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"respondwithlife.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ressgqlqhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restles.ndkdjndnnd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restless-queen-64bf.dotmay820.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200017982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restoposrms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restore-allnodes.network"; content:"Host"; http_header; classtype:attempted-recon; sid:200017984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restorecryptowallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restosys.sellvel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restricted-account-1000387346.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200017987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restrictionsprotecacc.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200017988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restrizioneclienti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restrizioneverificaconto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resultado0730.coop"; content:"Host"; http_header; classtype:attempted-recon; sid:200017991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ret98.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retiro.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200017993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retrgenac.genia-tori-ks.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200017994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retxieenik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reuafdhala.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reuntnbhur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reurctcoxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200017998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revirewactivate.traditionalcups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200017999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revisiona-aera-smartweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revisiona-app-bpercard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revista.facene.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200018002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revoke.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rewardsyncdappssconnect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rewdrdgjug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rewgdsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reynrjjove.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfbrkgdbwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfclarke.ie"; content:"Host"; http_header; classtype:attempted-recon; sid:200018009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfcumhtohm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfcvstfvzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfecepdrkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfeuwozdvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfltwztxhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfodnvomqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfoictghuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfpproposalnowakcabinetsofelkrapids.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfqcherksf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfqeutewby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfrhuvvxle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfshkmnfpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rftlcnuzts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfycpoqwpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfzachzkur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgavpgfgyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgbaryfsng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgbyxxtyob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgcbygylen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgfasdutzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgfzaaothy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgggpevwev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkkvyjzjb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkopmuehi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgkyuxvkei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rglhfmvuwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rglibcccrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rglsrsivey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgolpprxwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgprsfsvti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgqhhpwhxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgqrspsbwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgrhthg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgsolutions.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200018043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgsxvvidiu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgtgxhvpbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgviqriozz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgxupptwks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rgyotdgfgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhazaeyjnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhbxvozibc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhcvuelfzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhduefyoyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhfcypccpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhggjqvull.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhkssfntia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhlwiddqja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhnpbtjifp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhqxlyskrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhvmqpbyqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhvvjuwwpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhxebsvtwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhyrsqexil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhzgzwnfwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riabilitadispositivoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riamauchqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ribtudcrxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riconoscimentoidentificazione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riconsegnacarta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riearxvgje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riefgt.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200018070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rifwtnbwuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rigdoedosw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riguizi.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200018073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rijschooljoleen.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200018074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rijwaccwrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rikdkugmmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rimlomzfim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rimyhvzwdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rinnovare.lacasellamanage.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200018079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ripley-cl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ripristinacertificatoweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ripristinadispositivoapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riqtqkmvpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riraavwybw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ririaojypi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rise.metrety.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riseark.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risedefenders.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200018088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risemedicalmarijuanadisp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risersmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risinglove.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rismogxmvm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risnocgbaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rivalslot388.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riveroflife.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200018095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rixgroxtdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rixqtnjqve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rizajeteit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjbaawuwtp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjcvuidzue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjczlzrgtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjdzgekwqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjefbguhvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjgentolmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjglnraxyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjh788.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200018106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjhofqsglf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjhsxdatdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjilocheyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjjebcdmoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjpslkmlog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjqkbqrhft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjrrxrfjdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjsazurgna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjwjvywjkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjwtqvadln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjxjqadaug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkcgeizbpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkcrpxrvlb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkdjhpiqnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkdmxnhxzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkgroupss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkhddxdync.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkhrunuzat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rktcgjvzpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkvnpjglty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkvqdsjfil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkwkhadxtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkyyyozrtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rkzjnbccuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlaxmcwbpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlctohvwxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rleclomzvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlehwacdjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlgrlfmzdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlhpiruwvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rljkdnkzdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlkxblyjqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlpdmovits.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlqvytakvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rluymgycft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlvhpacwdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rlyoqucbky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmeishhhlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmesagykrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmfdwttnms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmfutbajkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmgngmrdic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmhihczucx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmkqzuylnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmmonqihom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmpnffpuup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmpoibximm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmsiepulia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmsnrkblib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmuvpgsbyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmybajdbmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rmzdpjokxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnaceifyov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnbjqbnavf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncfaeiddp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncijpghrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rncresearch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rndaaaaaaaa-6e3d1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnewtjxhat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnfuxvwrnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rngqdvsfzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnirkcptlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnjxhvxksk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnlettpbjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnojgzvakb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnpkupaznc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnssrdoptu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnvdpvmhul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnvndbinqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnwfvxahym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnygdwuelc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnzigapxbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnzqdlpheb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rnzxyzaxuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ro0vc.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200018181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roavhbumqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robertcarlsonlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robloxii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robodarenda.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robsuninc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rockstheme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roctxypqdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rodriguezadams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rodroigmvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roerfmufaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rofvlpurdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rogerverifyset.byethost4.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roisnoob.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200018195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roldachgur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rolitykinx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"romaguera.nwckdeqri6-pxr4kojor3gn.p.temp-site.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200018198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"romxn96.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200018199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronbbleull.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-chain.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-help.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200018202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninchain.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200018205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronkalman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronwspdvhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rootscomm.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200018208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rorgvugqrr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rorgvugqrr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rorlruhjsq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rosgipysfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rosshw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roudup-60b14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rough-wood-4310.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"round-violet-c0fe.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-brick.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200018219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-cpanel-wren.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200018220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-production-cf.tx1.mailhostbox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube0004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube0004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemail.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemanday001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemanday001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemiinday0005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubemiinday0005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticat-42a35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticatioalx2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcubmail-authenticatioalx2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rouwojnqbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal-meat.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royaleboxm11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpcehrjtng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpeqqmukrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpfjh.longous.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpinmbwjtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpkaxuqfid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpklomgvgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpnzxrtecx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpqreqppce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rprivksbyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpsgvtqybn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rptpcdshor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpywtmfbfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpzhznwkzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rpzoqmgzvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqamrfcjrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqarmihvkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqcosiaipv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqdfodwipz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqdrfvibbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqeqgquuiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqerqfnlss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqfxvbeoio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqgqxstzij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqhrrskmra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqihjanxk34n.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200018261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqjqqfdpfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqkkdaympb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqlmbtqyks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqpoqxvfww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqqesegstt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqril-ble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqtssgzmnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqvaeyyvsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqwjjufltm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqxxlvgzoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrbazttuen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrctfawngq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrdaojtuvl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrfaedbdgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrfwdqwymb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrgroup.net.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200018277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrhelyzmzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rriwy8.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrncdrewhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrnnjczdco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrnuftljjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrogvviwdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrribzeytj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrrrett543.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrrrett543.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrwzlowxbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rryqikdzdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rryxmuomks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrzmytqvkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsfhxzubxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsglyjljhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rshbokilqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rshplgeliq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsilaqltxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rskevrdpdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsmcfehlzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsmfqezery.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsopodravp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsouoxjzry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rspzagqhxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsropympms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsvkssajbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsvqubxdns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rswsknmnud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rswtbxnmkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtaesnyuta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rteambtlmh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtfklt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rthhyrggkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rthnadrjth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtiibxydwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtjtntxgci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtkbveqegg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtnctsplvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtoujypznt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtpagbuyjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtpaqqvwnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtrokfsakn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtrtfhfffrtyru.tfterhjgfdfh.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtuebzjtjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtuuaipeqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtvjlvfmcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtwlesjtol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtxequzrqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rtyuioxcngf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ru-realizac-consullta-rennerr-ls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruacfiyjnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rubzqwcnvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rudeunsightlyvertexitaupy.itaipy.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200018330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruepfgugfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruhxsqrioc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruijntolnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rujcrdgipg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rukhoslzgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rukutten.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rukzjshdkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rulemao.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200018338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruolrbsdch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rupeiouiet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rusetd.kepah-jp.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200018341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rususia.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruuybjmpqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruxadovaug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruxhiqhkik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruyhyigbjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruykbmcddm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruzzkhfslx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvghcytkng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvjkongywv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvkfdpwyjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvktwoipdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvldtjiaoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvmkyxlhue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvnfozksar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvnnvxabaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvqovofnrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvuvlucrbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvwkqgnuob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvwttfvekx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvxtajtrrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rvxuzjfbhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwgyjxpoue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwinjrrhek.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200018364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwisoueahb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwjioqurqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwllsmnytx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwrkfxedzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwrndxcivz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwuffhmthm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwxbnvknwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rwyunkvivc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxaxckbfbb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxbphrgfcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxdgrvpcdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxdlfytkaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxdzsxemzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxgvudandh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxihheufne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxivehnzsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxiysqxnpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxkzvcfrqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxlhbbkxxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxlwzgjexm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxonoimjji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxoynxwntv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxpduqthek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxpdxmqczd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxrxf18.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rxupdwojaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rybehmjxxu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rybqiatvby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryeixnfxzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryfnlxqdpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryheyooxed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryrlxcjgls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryrxzxdypc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rysgwatszo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rywdhnligo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rywusphhbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryyvglupzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryzjikrluy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzefctcesm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzgeopeqwd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzigqglyod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzkmihxaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzllqtvsmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzmdjidgjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rznsscjzvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzpvjmiwdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzubutzvas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzyaostckj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzzahduqtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzzffmozqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200018414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-fa31f3-i.sgizmo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-id-sp.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200018416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.eliptic-sohochain.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.eu.premiumisp.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200018418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.free.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200018419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.infidefi-smartsync.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200018420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.yam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s104318.gridserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200018422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s1mple-case.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200018423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s23.proserv.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200018424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s2yiut.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s3.fr-par.scw.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200018426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s3.pl-waw.scw.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200018427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s3ntralp4gec0mun1tyac00ntactiv.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s3psi4lac0unt4ctiv1tyy0urh3lp.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200018430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s52i0t.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s5r7pt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200018432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200018586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaaieesecsesoe.saccacseoeriaor.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200018845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200018878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200018891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieesacseoe.saccsecoiaarser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200018973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200018995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200018997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200018999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaeieescsceoe.sacacsceorira.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiceesecsesoe.sascacseoeraior.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaieeecescssceoe.saacsacerseoorrai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaaiseecseoe.saccseoicar.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaeaiescssceoe.saacaceseoorcriaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200019842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaiasecsesoe.saccaseoeicaoras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200019918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200019969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200019970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200019993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200019994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200019999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaicseecseoe.sascseoacir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceesacseoe.sascsecoaiarser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieceescsceoe.sasacsceorari.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieiecseercsooan.seesaccoeosoncnrii.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieisceecrsoona.seeascscoeoonniri.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieisceecrsoona.seeascscoeoonniri.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseccsorn.osaeacesseocnionri.ptyslj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaieseecasoe.sacseoiacserr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200020615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200020646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200020662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaaisceesoe.sacseoicr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200020809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceessaivceeaririscronor.aseaiecseascioconaaosesonseiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200020963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200020967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200020993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200020995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200020999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200021413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200021862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200021950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200021976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200021989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200021999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yunshufen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.shanchu19.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200022470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.lyeonk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.gzj5011.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200022858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ozryoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200022940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200022992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200022999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacommodation.za.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200023143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200023227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200023259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saacsecsesoe.sascasceoeai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200023386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200023416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaecescssceoe.saasacesceoorr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeereiesercscocneom.asoanacaeosoenr.glpzvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200023542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200023572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiascsceoe.sacacseocriaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200023698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200023728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeiescssceoe.saacacesceoorr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeisesoccnem.aosoaeosnen.oanbrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaeisesoccnem.aosoaeosnen.pxgpjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200023856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200023887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200023900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaicasecsesoe.sascaseoeacioras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200023980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200023997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200023998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200023999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaieacescssceoe.saasaceseoorcraias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kwrtwl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200024233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saaisacseoe.saccsecoiaas.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saas-8022d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200024240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecicaaccrirsoonar.seeascacrsooaocaoreosnnaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecieaacsrirono.arseaecsescocooaoeosrnmaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecisaacnrir.soearacseosniaoeoosnmeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasceecisaacnrir.soearacseosniaoeoosnmeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaaccrirsoonar.seeascacrsooaeoaoreosnnaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saasciecicaacerircsooarn.seesaacrcooaesniraoenosnaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacorirn.osareacesseocnaooeosnmraosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacorirn.osareacessoccnaooeosnmraosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssacroooaaoeorsnmaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saascsecicaacsrirono.arseaecssoconaooeosnrmaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sabadellpagofacil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacmhs.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacolaprodut09123.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sada1autoinsurance.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200024262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadervoyages.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadovxetwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safegnosi.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safeopenpattern000123.nighper.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200024266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safety-acount-security.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safety-verifikasi-account.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safewalletrectification.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safjaufklx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safraempresas.com.br.mcas-df.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200024271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safty.summarycheck.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200024272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saftypgsscrtyfbpags2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safuu-launchpad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sagdicogullari.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sagilca.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200024276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sahleymadison.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicasioen.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiccosoiaecsien.oc.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicescsoicssien.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saicsacseoe.sascsecoaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiecascsceoe.sasacseocraias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saieeresesorccnem.aosoeocansenr.nedltv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saika69sex.monster"; content:"Host"; http_header; classtype:attempted-recon; sid:200024594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saintbarkleyshoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiokkrphx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200024682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200024713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200024726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiscasoe.sacsceoias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisecson.seacsoni.qjpov54.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200024756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saishainstitutions.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200024757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saison-cardpomd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saitadobrasil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200024759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salamalands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saldanaca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salesdoc.evdpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salesstudios.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saliksnas.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200024764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salkunsukimasa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salmanfarsi01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200024766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salokaanburja.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salsaytimba.org.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200024768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samaelinvestments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samakalinsangbad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samilitaria.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samirdesign.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200024772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samkuuhymb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samlikanada.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200024774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sammarone.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200024775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samrockchem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samuraishockdo.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200024777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samvision.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200024778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"san-dbox-home-lojaprincipessa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandalychacosklep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sande546rsonfarms.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200024781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandeeppk03.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200024782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandersonphotosonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandmay.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200024784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sangem3.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanjilkumar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sankyo-m.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200024787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanskritismartkids.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sansound-nft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sant-1-bd0e47.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200024790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santa565sac.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200024791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sante-infos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santehraboti.by"; content:"Host"; http_header; classtype:attempted-recon; sid:200024793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santoshpolymers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosnifqre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sapujeskag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sarafogliapodologo.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200024797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaaieseeccsocrn.orsaeaciesseocinionriii.gjedqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sashkssfzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaeeseeccsocrn.orsaeaciessoccinionriii.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasiaeeseeccsocrn.orsaeaciessoccinionriii.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasieascececcsron.sieaciorsaeronsiinveri.zcwxrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasmaoeee145.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasmaoeee145.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200024806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassaeisecececcsornr.seiaicsioreioenisinverii.ojvntr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieesecececcsornr.seiaicsioroicenisinverii.sjmogv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieseececcsconr.rseaicisoiorniiesnvierii.osqsyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sassieseececcsconr.rseaicisoiorniiesnvierii.owekid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satay-secur.reconfimations.pagedisabled.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200024811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satuzsqgut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sauc-107438.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sauinwnfid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sauxgfnbqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saver.kinqsteelcorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"savingsfordentalcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"savvycraftymom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saw2ly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sawqwds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sayedammar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sayratravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbamfvcypc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcglobalmaiilupdate.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200024824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcglobalverification100.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcglobalverification95.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbe.mut.ac.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200024827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sberbank.id4541.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200024828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbfastfood.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbgjwynfcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbhkrhkgzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbkcaqcgey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbmptn.bintangpelajar.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200024833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbnaxequpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbndjurxjk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbopueqsop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbpnqegnlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbs-siebanlagen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200024838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbtlgrdqnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbtpdxzdvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbtufpiruq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbvneapocp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbvrzybxjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbzczkeuds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sc-01111000.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sc.apartmentbardolino.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200024846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scagqbkvol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scanoffice365-owa4874.microsoft365scan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200024848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scarf.metrety.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaryrahhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaseeissason.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sccaxgbadr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sceiplc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sceniccable.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scepgmdman.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scgnotbuhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schmittner.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200024857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"school.greenislandtrust.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schryoebfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scintillating-starlight-e4ac34.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200024860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sclpllgsys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sclswisscom.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scmbxlfiuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scnijqpaso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sco1992999.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200024865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scotiatrustcu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scqfyiojro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scqjhehmly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrotxajnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrty.cold-thunder-d531.siteacn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200024870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrum.lytous.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scsgksbgew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sctizwjfqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scvnrkehgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scwvcvpkbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scybhhestd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sczcogpivy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sczomcexas.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200024878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdapegoqzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdeadokbqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdfghjhgfbtinter.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdfjlsdvnsdjfhvsd.sdfjsdbklfsd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200024882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdfoil.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200024883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgh765.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200024884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgvsdvsdvs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdhekaehkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdhgfdsdfghg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200024887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdiqvhqpam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdjgssgysb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdkflnsdkvmd.fsdfbsd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200024890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdkgoupkqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdlssozzxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdlugaxufi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdmpeceatl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdmtgynavm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdsmggsrwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdtoxaomxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200024897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seabnb.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200024898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200024916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceccsaonrir.soeaacseosniaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200024928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeecacsoirncr.soreaacsieosnaiciaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesacecirscronor.aseaiecseascioconaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceeesaceeirccrsoorna.seieascasciooocnaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200024992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200024998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200024999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceieeacseirecrcsoroan.sieesaaccioeosoinaoeosnmer.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceacsrirono.aseaecsescocoaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacesceaecrirsoona.seeascscoooaaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeacceirscronor.aseaiecssaocionoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciesseaociniaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaceseeaccsirocrn.orsaeaciessoacciniaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.fahxqk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seaciecsaeerircsooan.seesaccoeoasoaoeosnmer.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisccaecrirsoona.seeascacrsoaeoaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccacsrirono.aseaecssacrooaaoeosnmer.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccaesrirono.aseaecssoconaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacesseocnaoeosnmer.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seacseccasorirn.osaeacessoccnaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seafooddeliveryapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200025328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seal-app-k2wcm.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200025329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.chashanchu21.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gjglse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.l4p2g1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qskgtg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vkpock.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.chkmuq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rn5mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200025957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200025971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200025990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200025991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200025999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.rzuxzq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.nrmzy6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.tilzhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.7ngywp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.invpbv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vfqske.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.9v9w2y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gamxhl.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.wl85i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200026566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebat-dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebene27.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secauchhssservice.rtcgroupholdings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sechxdikld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seckueide0-92884.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200026580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"second-rate-assignm.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secrsx.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200026582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sectcgoqdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-alpha-497da0be515757web.gidiagents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-btbusiness-3249d5.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-businessbt-app.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-businessbt.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-dashlane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-reconnect.dinamic-ourtime.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-runescape.xgm.rnp.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200026590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-sligth-document.ertoolfo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-validate-and-verify-business-and-private-emails.d1z0uq42dwskuc.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-c.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-rs.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-t.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-v.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.prefection.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200026597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.staman.direct.quickconnect.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200026598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure01-uspostserv-uservices.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure02-ustrack-nship-uservices.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure07a.rvrentalssd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure0fficedoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure1.ddns.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200026603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure296.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure45-sfr.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure55.webhostinghub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure6y-commonwealth.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccountsavedlogin2023.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccountsavedlogin4665695955.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccountsavedlogin545856656.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securebusinessbt-com.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securebusinessbt-hub.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securecuserver.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secured-message.outlook10.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secured-message1.outlook10.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedocument-ccrrllc.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedprotocol.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedsoftdocumenteoileowgdhgtdueweiveoendudssdg.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securefacebook.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securefile.jennitai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureloginupdateinformation56652654215642.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securemtbalerts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secures-pal.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securesforvoicerecording.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureupsdelivery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securewebapps.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securifywalletsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securisssty-admina.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securiteloginfr-b97681.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-1000000006983265874926859836593.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-2000000000234569875326561.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-2000000000234569875326562.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-4000000002346598745623656.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-6000000659846985642369874659466.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-admadsdasin.yourtrap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-americafirst.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000002589876345698599.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695361.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-100000006973265984695362.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-30000000025643986592610.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200026640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-fb-800000002563986495629855.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-page-community-standards.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securityaccountprotection32564.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200026643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securityexit.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sedaynahavand.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200026645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sedekahchip1-5b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sediver.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seedify-ido.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seedify-staking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seehere.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segubisa.0hi.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200026651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segudprovinaires64738.filings.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segunda-serve.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segure-citizensbank1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segure.application.dev-statistik.boyolali.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad02662.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad0662.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad902290.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad904490.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridad9097.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridadbancopromerica.soporttrpotp44o.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridadbisytem.bienlinea1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridadiitauuubanckonline.gsgdsf4qq5r.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguridaditaubankonline.soporte123445.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguroitaupy.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguronacionalcr.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200026666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguropagoapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200026667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segurosernestovillarreal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segvxd.j40nf89.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sehdnszizo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seipl.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sejsloao6181.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sejundlbqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sekbcjdtqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sekykrjszu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selecciondeempleocr.webnode.cr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selfreliant.cabilascamoma.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semanario7dias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semwnhtfeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendungsnachverfolgung6-chpost.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200026680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seniorbarcafe.arularensa.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200026681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senscommunication.mjm.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senvzrfbit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senzaaohjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"senzati.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seoservicesiox.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seoservicesiox.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sepmsuoxuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seputarbet.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serch26.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serfinanzavirtual.bancoserfinanzas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serfrtgtgrf.byethost9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sergiorica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serpienteonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sertaocentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sertyxese.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serv5.servs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servcemps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-11-collab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200026701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-7-collab.land"; content:"Host"; http_header; classtype:attempted-recon; sid:200026702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-data-20d8d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-data-20d8d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-dxths3.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200026705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-emall.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-hrmpb4.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200026707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-networksolutions.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-uwzj6.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200026709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server.yahoomaiii.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servertechnicalnoticeimmestae-reconecting.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviboawakjraopem-bc3203.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servic-4096.awuqohsjo9847.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-orange5343587-bbef5d.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service.runescape.com.os-rs.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200026715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceadhelpmeta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceadhelpmeta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceappsm.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicecheckupaccounted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceclientsa-bc3d77.ingress-florina.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicecom.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200026721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicedoc001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicefbhelpmeta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicefbhelpmeta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicemailinfo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicemms.weezbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceorange537.upgates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceorange537.upgates.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200026728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicepage.service-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicepublics.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services-lnfoguide.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200026731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services-seller-central.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200026732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicesbancaire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicesclientscontact-96d9a4.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicesdibakundenservers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicewhereyocanregisterkeyword45615852.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicioalclientebn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviciopinchinchia.appdigitalperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviciopinchinchia.appserviciospe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicios-2.bprovincia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicios.bprovincia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicios.bprovinciar.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicios.provinciaars.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviciosantibloque0r.reception090.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviciosdigitalespichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviciospichinchapp.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servics.validationsecuradm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviqconsultants.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servisaludec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizi-dhl-express.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizi-web-io.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizio-spedizioni-bp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizio01-restrizioni1.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200026753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servizioappassistenza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviziocarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviziodispositivoaccesso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servmailclient5.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servterm0.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servterm4.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setda.tabalongkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setupmynorton.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setupyouraccounts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seul.unilurio.ac.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seunlfsppo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sevenlee-it-solutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sevenmaxguns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sever-107683.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"severescalytransfer.quesopapa.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"severeuncomfortablewebsites.kalwiwe.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sewaqbyvrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sewytydj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sexytitty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seycvppxav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seyyvhnlsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sezionecarte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfaipsozqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfb.cfkreer.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfbjtdbnhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfdsfdsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfebjzjymd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sffxwszcaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfghdgheda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfgmgkrdmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfirstrepublic.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200026784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfiwkhkmsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfjyuechlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sflinflcxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfltqnnnxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfnlcptpkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfoxnufvno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfqkscznwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfqqtprpmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-abonnement.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-anti-fraude.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-clients.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-contact.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-espace-client.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-espace.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-forfait.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-protection.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-support-client.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-telephone.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr.ssl-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrnotifsec-b97681.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrpanel.lws.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrsupport.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200026806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sftjyvochw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfxxsozfbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sg-dbs-paynow-paylah.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgcdmptdmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgeelugrwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgenlbgneq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sglktzvouv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sglpultbxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgnin-att.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgnxressfn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgtbalde991-dot-still-dynamics-321006.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgubtfhsfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgwhfnyokh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sh.mfuture.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shahidaclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shahjis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shanky0.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share.ebforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-cloud-preview.post-confirmation.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-cloud-project.reading-voicee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-email-files.documents-project.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-files.messseg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-folder-private.nhilenhil.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-private.files-auuth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedfax815201376.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedviaonedrive-share.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharefile.prep.kaudiaestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharefile45123121y50.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint-f0e5f5-8c91-49fc-af1f-cb56b5f54a61.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.hi-old.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.timelessincome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharingshopsecurespottedcloud.hubslateplaces.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharkznft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shbqphcigz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shcyieewsi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shein.ooc2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shein.us-spin.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200026845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheindia.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheingt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinimporter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinjewelry.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinofficialsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinoutlet.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200026851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheinpromo.company.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shermiyamosley.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shhiyoftge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiba-token.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200026855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaapp.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200026856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaaudit.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaclassic.sc"; content:"Host"; http_header; classtype:attempted-recon; sid:200026858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaclubnfft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibasswaps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswap.mypixieset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswapasd.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswapsss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaswapusd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibaunu-bone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shibbaswapapp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiikig.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shikimei.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200026868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shilpment-helplng-bbf0f6.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shinabiouenl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiny-sound-a24a.rcvrysrvce.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shipment-post-at.apolline-voyance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shipping.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shirazrobotic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shitverse.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shjrmqipcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shjwlxnqtu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shmqxraruy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shnerelxxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shodazxzlr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shonmrzvbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shooponliine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shop.fixyourdirtbike.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeecoins.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeeday2022.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeep.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200026886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopping-allegrolokalnie.3659512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200026887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopypanda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short-url.upr.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.mypaste.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200026890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.upm.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200026891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl-ddc.moph.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200026892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.ac"; content:"Host"; http_header; classtype:attempted-recon; sid:200026893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200026894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"showysizzlinginformationtechnology.hauhrj.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shr-sharedfile-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-flower-70e7.wearesre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-resonance-baf8.westloanewre.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill-waterfall-e99f.mooreslaw.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill.nxazenom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrillstudiousinstructionset.cutestars.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shuixshur.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200026902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shvntzvcsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shwtmbukcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shxxfiepjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shyxoxmdkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shyxqetuwc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shzlzpzrlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siarumcecx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siatamask.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siayu.indramayukab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siber-ingenieria.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200026914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sibksmcosz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicher-in-mathe.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200026916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicheresloginservice.dyndns.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicherheitscheck-onlineportal-spk.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sichifukusato.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200026919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sickyaypcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicredi.clienteempresaprotegido.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicsxqgfyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicurezza-credit-agr.etechnocrat.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200026923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sicurezzamywebbperita.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sid-service-center.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200026925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siddiquelawassociates.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siempredavivienda.davivienda3.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200026927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siempredelamano.atwebpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siempremas-pres.cardrabbit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sierraautocenter.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sierradorada.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200026931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sieuthidochoixehoi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sifqrobmqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sigarte.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200026934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-18j11mw7cmkpjxmfrcjs47u4rge2l657kyrbiq2ve64ku.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-1uwcwngkv6addzgek46wx7attvjaromcpeeuhynjt6gne.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-3hmttxgquqfl4idw57vwqnufgz6c2fpnbb10i15enspge.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-4uy5juyk7im1ugmf83tcku3hv1i8m657lx80ete7ydi4x.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-88uil4pl0fpucfx7pph9k69d4zt7op37s8mp6o2pufewq.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-flcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-flcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-il6izs6n9v8vctpc1ct6n1d83eubvfy58ih4k81olj9e9.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-101327date.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-verification-929bb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-j5im9qho48v2l386wjvt14ixmdc647uh4d35uvu3ndm6u.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-n78fym67pmytj2r2qx7j3iim04ag8ziesx7b12roi2zle.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-on-idaho.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-on-vystar.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-zclwo5qvsr9quu5c5lxvn9x9hg20zqws1u7itosvwuvyo.website.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signedlines.wavoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signhunton.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signin-att-yahoomail.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signin-attmail-109155.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200026953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signinamfc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signinamfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signon-veridian.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signon-veridian.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sigulemada.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200026958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sijkcyrpjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sijpjyhakn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silahkan-konfirmasi-akun-anda78.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silent-darkness-b676.t0eajfnk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200026962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siliconescuritiba.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200026963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silikalthailand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silutrcwtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silvbcozwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sim-mc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simetol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simgeprek.blitarkota.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simiandme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simpkk.karanganyarkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplissimot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simranarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simtvswads.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sinbarsftc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sincherelink.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200026976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sinfocreative.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200026978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sinrsdjygj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siotprddiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sip.vedita.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200026981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siporados15585.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sirkxlnnow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sirwadin.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200026984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sisale.2022outletsdiscount.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200026985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sisamaks.bandungkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200026986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sisdcnfptr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sisiac.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200026988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemaverde.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200026989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site-4403463-3995-6112.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site73-bd0bf7.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200026992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9423623.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9423773.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9434107.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9548676.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9551459.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9552191.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9606042.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200026999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9607677.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9608556.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder157806.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder158541.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder159641.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder162459.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder167178.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171156.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171476.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171681.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder172240.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder173021.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder174827.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder175112.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder175184.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176184.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176232.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176317.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176428.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder176444.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177623.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177677.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177785.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177855.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177881.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder177991.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178250.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178264.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178357.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178367.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178444.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178451.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178536.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178590.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178591.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178754.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178758.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178795.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder178983.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder179131.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder179144.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder179151.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sites.wistech.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitobpr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siucvbjyrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sivetgjcsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siwhasbkwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siyaamoda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siytppgdyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbbezowmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbhbhvff.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjbpwvohqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjdaemzazr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjedwjdcpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjemhycito.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjfmsxxohl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjhdegdfeg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjhdtlrtkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjioauxmzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjjpyjpxwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjktrmlrtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjl7eze8.dreamwp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjvejinrvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjwkoynplc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjxigtbnlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjzdmvmtil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjzsswdstt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skbhmihazl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skfkbimcoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skgesnwzin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skgvujphyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skillful-vigorous-fighter.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skilltransform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbasics.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.biz.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200027074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.org.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200027075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sklepkody.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200027076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skotqbyfre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skovibkfqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skreldpewj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skuexyqmzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skuswjyaae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skvaecdujx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skwcbrjimp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky247id.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200027086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyhubtelecom.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200027087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skymavis-ticket.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200027088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyqrkryhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sl18839399.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slbukszhja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleepmaskz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slicktech8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sliljrdxmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slkebtscuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slkoksjmpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sllruvhegv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slmfrrmzer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slmkufeckf.jon-jensen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slnijxoiai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slosansqsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slouchy-piece.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slowlinebag.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200027103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slutkissgirls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sluuhbqhfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slxbffulfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slyzjsgidn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sm2concierge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sm777.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smal.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-bread-5670.wvesadsdfdsfd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-disk-48bc.f57ny24z.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-dust-6c63.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-rice-d2df.wadestones.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smarrtscoire.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smart-trade-group.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartbperweb.q-exclusive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartbuygh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartchaindefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartcoiirnresolve.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartcoirntechsoluition.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartconn.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartconnectionv2.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartcoonnectwallet.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartfix-dapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartgridsweek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartmom.com.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200027127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartplant.pgaek.by"; content:"Host"; http_header; classtype:attempted-recon; sid:200027128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartrecsyncauth.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartstoresoffers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartvalidation.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200027131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-card.bkufj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-nhx.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200027133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc.cardinfot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbcoyy.kc5v6f.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcjnxkhug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcovhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smdoroqiek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smdvbdavsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smepp.uninp.edu.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200027140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smfwksoval.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smgeenlnle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smgolamalif.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smhxtthwyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smi.onlygfpics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smiepyjhwx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smileyribus.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200027147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smixoxgeyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smjzyphabk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smkkesehatanjember.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200027150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smkkgxoerb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smlzvhycjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smpaambwvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smpfhukyua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smpyvzrcnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smqpvevqip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smqzdxqqeq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smriqezgoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sms-afcu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sms-afcu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sms4citizens.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sms4citizens.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsenligne.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsmms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangephonemail.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangesmsmessage.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsqvkafbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsseguro76.sms543.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsverificationmms.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smuqifdmrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smvrzvqrnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smwitnpslm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smxmutibii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smygduodoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smzeadaryu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-066660.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200027176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-28273739.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn0010192920.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn01002900.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn28393030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn91892939.byethost15.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snaiat-blioury-streurs.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snaionds-threiay-physeusm.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snawfnhbqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbqmjixef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sndspnuztf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snffeqmezu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snhshmpeev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snikhers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sniqkkaitj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sniuopgfsdfsdfahgf.snigup.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snkzkureia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snn919200390.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snndqhphfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snourbrkek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-hat-34e4.woomnodesed.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-recipbaf.f57ny24z.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-viol.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snphrrxiyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snpwmmtsry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snqyfmymev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snrjynflyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snrozhuehe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snsiccolnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snt-manometr.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snveajoajo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snxnuquerl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snxwljyjlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snzbsbhlyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snzcyfiiom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"so932809.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soanse92.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soarcondicionado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soazkvanyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobat-kaltara.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialinfluencer.co.place"; content:"Host"; http_header; classtype:attempted-recon; sid:200027218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialscrtypegesinfrmations78345682345.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200027219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"societegenerale-relementation.sad-borg.161-97-101-64.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200027220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soejfiyyqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sofe-firma.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft-waterfall-85d3.henhigay285.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"softbanki.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200027224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"softboxtechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sofyhtrqop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sojtctatyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanahackerhouse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanatimes.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanaverse.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solawi-edlendorf.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solgasmedical.com.ve"; content:"Host"; http_header; classtype:attempted-recon; sid:200027232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitar-prestamointerbank.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitatucredipersona-cpiura.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200027234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitudinmediata.telebankmweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitudprestamoalinstante-lbkperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitar.tempetahu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-butterfly-f885.execuisine672.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-recipe-2221.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-shape-8829.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitary-woods.a30u7ihn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucao-para-todos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucaodigital-online.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucionesach.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucoes-para-nos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucoesr3.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solutionscointec.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopbant44546.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopo4873298.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soportebanco.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soportenlinea24h.uno"; content:"Host"; http_header; classtype:attempted-recon; sid:200027251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sorriaodontologiabh.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200027252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soscoevents.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200027253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sosfresh3sdf.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sospensioneappcertificata.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sospensionecontoparametro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sotajrkymw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sotoesteban.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"souajjiehd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"souaxwaoh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soulbound.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soumya252000.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sour-pale-lemongrass.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"south-africa-postal.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-clean-algebra-356021.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-hardy-magpie-334101.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-noted-minutia-330211.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-semiotic-karma-356909.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southbaywedding.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sovffejkyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sowkchesyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soybhjhgod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sozvpyukdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp379189.sitebeat.crazydomains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp477389.sitebeat.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200027275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp539061.sitebeat.crazydomains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-dezentrales-sicherheitsportal-11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontodepots-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontoeinzuge-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontofiliale-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontofilialen-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontogeheimnis-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontogewerbe-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontogewerbes-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kontoguthabenkontoguthabens.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundekredites-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundekredits-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeleitzahlen-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-akquise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-bedarf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-konten.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundendepots-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundendepots.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeneinlage-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeneinlage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeneinzug.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenenaufsicht-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenfiliale-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenfilialen-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundengeheimnis-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundengeschaft-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundengewerbes-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenhalter-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenhalter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstituten-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstitutes-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundeninstituts-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenintern-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkapital-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkarte-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredit-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkrediten.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredites-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenkredits.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenlehre.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenleitzahl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenleitzahlen-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-de.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-loginmain.deutsch-bnk-login.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-online-service.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-proton.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-1036.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200027323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-1041.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200027324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3021.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3026.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-checking-3036.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server8.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200027329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de.vertrag.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200027330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de.zugang.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200027331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.sp-verifizierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.spk-verifizierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-glitter-159f.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-mountain-e6f3.qf12346274.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-rice-5e44.rockymtmgt969.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkly-crumble-37529f.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparxinteriors.co.zw"; content:"Host"; http_header; classtype:attempted-recon; sid:200027338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spd-login-site.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spectrumstorageaccess.yahoosites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedisci-bper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedizionecard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spedizionepay.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spemail5.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200027344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spemmjtrgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spentamultimedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"speshcats.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200027347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spfgttazok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spfkgeavqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spingame.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spirecg.corsetul-boston.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200027351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spiritswap-gow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spjthmvlcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-aktivierung-kundenportal.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-aktivierung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-aktuell.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-dezentralessicherheitsportal33.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kontodepots-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kontofilialen-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kontogeheimnis-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kontogewerbe-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kontogewerbes-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kunden-online.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kundendepot-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kundeneinzug-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kundenlogin-online.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-login-anmeldung.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-login-support.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-push.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-pushtan.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-update.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.customersde-support24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.deguidesrv-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.srverguidede-lnfoger.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.srvguide-servicede.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.support24-customers.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spkfod.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200027377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spl-line-bb3b75.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spldwsypdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spontaneous-churros-b9dc92.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sporing-posten-no.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sport-pay.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sport.protected-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sportsbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sportyelites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sppk-update.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprechls.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spring-hill-80e4.westnooood.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spring-unit-2937.terser-ham-0g3631.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprpxpyfqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprtrcvry.cnfrmacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sptfqexegm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sptqpydvye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spurious-verbose-tv.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spvvivlkyk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spxqxyxhaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spzawpfntg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqafyvklmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqbgjkgxun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqeamnrcla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqesdysgod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqfpntvxxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqhicaxmfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqkufy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqlmzjbcgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqotelciyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqqssqdwwfwwf.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqqugayzup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqtwxrznas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"square-breeze49.8re42b1g.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"square-tooth-6e6c.deemgriff6215168.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqvhmeyshl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqvsrlbvab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqwtisjeor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqwuegcemk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqxrgxhtir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sragqgbani.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srchrank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srfkvnjsmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srhurveeym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srhuuhpweb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srisupfgzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srjpnnsxhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srmkwdlljo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srmtazxslt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-cteetonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctevczesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctevoersd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctevoonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctevrsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctezaonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctrarsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctruzsand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-ctruzsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-cuiuocand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-sueaerd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-suecxzd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-suocand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srnbs-suocecd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srrato4agest.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200027440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvde-lnfoservice.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srverde-supported.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srxuqzsxgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srzevxqoes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srzrsnmead.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssbnfetvxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sseguridadebrou.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssenclave.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssfskwkclq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssghibaswaps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sshibasswaps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sslxzzrrxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssmsdtlbie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssnugiizjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssnuoesbbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sso-garena.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssokhfnebv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssrhtckwmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssssmezhot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sstakegamble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssuqvjsbty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssw2.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sswaerfuaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssygnhdmga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"st-online.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"st-sharedrive0utl00k-365doc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"st760937569.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stableprojectfix.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200027468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stackexchange-incomingserver-ch-bcb8a3.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stackingchange.mymom.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staemcomnnunity.net.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stage-upgrade.nycgo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging-app.1inch.io.s3-website-us-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.aisecureme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.cleaningandmore.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200027475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.egfwd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.halaladvisor.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200027477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stairwayscommunications.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stajzydgdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staked-lido.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stakes-pancakeswap.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200027481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staking.axie-infinity.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stakinghexlocking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staman.synology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200027484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"standorete-paketeversenden-ch-bc54d4.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas-prizes.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.os.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200027487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200027488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starttsboxfile.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"state-and-country.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stateramain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static-promote.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static2.qeei.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"statisticssuccessheroes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stbzhtxecq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steam-communilty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomminuty.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200027497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommnuinty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommnulity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommuilty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommuinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunety.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityzin.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200027503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunityziw.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200027504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunllty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunutiy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomunntiy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcomuunlty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamrcommunity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steancomnulinty.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steeamcommuniity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep-water-ae2b.weslaox.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.bengkakbibirkuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.kacangrecinonfirem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stemacommunity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step2-9f5d0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step2-9f5d0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step3-efc8c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step3-efc8c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step4-30f38.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step4-30f38.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step5-62e6a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"step5-62e6a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepapp-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stephaniesmythe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stephendedwards.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepnactivationdapps.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp10-98e14.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp10-98e14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp11-a7e2a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp11-a7e2a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp16-52ee1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp16-52ee1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp17-d761f.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp17-d761f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp19-ced6c.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp19-ced6c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp7-98a8e.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp7-98a8e.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp8-c4298.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp8-c4298.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp9-54a62.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepp9-54a62.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steris.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200027544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddencanadashoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddennetherlands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddenshoe.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevencrews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steward.instanthq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-butterfly-7353.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-cherry-4888.hescohqq.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-mountain-a0ba.7pok2uvb.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stnsniumgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stnvafrqbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stocwbxtub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stollgroup.coms.cso.gov.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200027557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stompawzed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-dre.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-dre.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-eche.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-eche.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-get.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-get.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-hol.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-hol.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-iq.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-iq.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ko.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ko.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-mx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-mx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-nds.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-nds.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-nik.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ow.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-ow.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-rp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-rp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-tet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-trc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-trc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage-wof.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storageapi-new.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storageapi-stg.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"store.steampowered.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200027587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storeallegrolokalne.9554315455.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenike365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stpgssdxmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stprxxahrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strangersxyyz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stratoitigroup.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200027593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"street-machine.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"streetmachine.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"striicswgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strikeitalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strocking.faqserv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strugglestokids.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stspmwdwue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sttakegamble.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sttudzlcqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stty.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"student-finance-portal.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-help.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studentfinance-help.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studio-lol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studioglobalfashion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studiostones.fresh-cake.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200027610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuffnstuff.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stupina.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stupyaumxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuttgart-valley.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuye3890.byethost6.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stviqshsau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stvwfkbxgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stwdruytjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stwrjhdidt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stwwcyfmup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stxaavcnfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stxpxkjfef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"styleproof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stylifehomedecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stylishingapps-documents-webapps-6ck5e.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stypthadbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"styrimvwmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"su.vc"; content:"Host"; http_header; classtype:attempted-recon; sid:200027628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suahudshhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suas-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sub-evnt04.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subjjflvvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.refund.bgl8w.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200027633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.tax.refund.lpivp.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200027634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submit.tax.refund.r1mi3.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200027635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"submitcreditentialindfitmations.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subscriber.hjyl168.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subsmartlink09.eventlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200027638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subsworker.bid"; content:"Host"; http_header; classtype:attempted-recon; sid:200027639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subulussalamkota.desa.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200027640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"succesbancolombia.successbancolg.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suchiappswap.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sucursal29854888.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200027643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suelunn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sugvpipqnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suissepost2022-001-site1.atempurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suisslbenaa-bcdfdc.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suiviticket.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suivremypost24.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suizlyymft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sukjsgwvih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suksvhpktg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sultan-raza.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumary.repport-fb.accts-protocol.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumicorp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-fb.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-protocol.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-tracking-package-problems.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary.2waky.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sun.eduzz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suneos.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunnylandingpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunpolymers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sup4team.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supe.seharusnyakita.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-block-1b89.tmp6n9c0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-outubro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-voodoospells.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superecharge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superfulnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200027670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superrefund183798.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"superrefund183798.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suplicgalicar.supploc.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supp0rt-ovh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-findcol.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200027675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter567106982.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter716262119.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-helpcenter716262119.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-kundenkonto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.globepropertymanagementservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.lost-ppl.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200027681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.rld1.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200027682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support24-delnfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supportonlinebperitalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suprim.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200027685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sur3cr.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surprisedcautiousrhombus.16092022.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surrree.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surugabanks-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200027689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surveyol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sushiswfsdfgdfbc.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suspivefyu.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sutherlanglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sutumiksak.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suusnvuhwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suvvcmayjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suyi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suzigcyyie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svkgawhuov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svlncezwda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svnbpaognr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svnzsmtrsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svobpvrxkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svp2.youtube-booster.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svphxdpors.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svqcjjpuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svqvpxwhkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svrdnykoje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svtauwsrbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svvuayiuvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"svwlczodmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaggerhub-noprod.mibanco.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200027712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swal.tasarte.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200027713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swanholm.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swanzltkkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swap-bsc.tokentool.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200027716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swappauto.staging.lcsolutions.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200027717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaptoday.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swapuni.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaydewiku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swcfqiagln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swdmuiqffr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swedbanklv-update.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swedbanklv-update.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-efax7656554545-aebf.82929222-happygringo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-math-855f.jpatelvemvo9033.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-sea-37d9.vgreengolf8866.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-shape-2161.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swfgcdtdtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftkeyswap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftszapprotocol.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200027731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swipeindustry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiss-card.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiss-post-client.westeurope.cloudapp.azure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiss.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiss.paketversand.51-145-172-36.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switstart.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switzapps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiziapro.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swkptlkqor.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swmpkuafqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swnkrtrnpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swp-connect-poocoin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swqwqqcwqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swtwplrmpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swujdiinge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swxaytbshx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swxsbrbpze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swzalfrwcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sx6l7a.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxaemcdths.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxaobuoybw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxardjjcbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxb1plvwcpnl495429.prod.sxb1.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxbbaqzavm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxdgmemgnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxdgutqzir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxhuddfoob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxhvczqwhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxlzwywxki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxmpjzmnct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxmyzuwnyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxocsyqcld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxomfhppbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxqglufscr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxrhsnecig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxwpkelija.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syabtvankw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syadtzovta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syatwea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syawpxbdpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sydenhampharma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sykdviteeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sykrfvuovg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"symimfkffg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"symppzicmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synaxisreadymix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synbwimumo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sync-rectificationerrors.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sync-tool.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200027782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sync.saveukr.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncbotzfixer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncconetbinace.quest"; content:"Host"; http_header; classtype:attempted-recon; sid:200027785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronisation-02.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronisation01-c200b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronisation01-c200b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronisation03-1b705.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronisation03-1b705.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synchronizationvalidate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncsdapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncvaliation.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200027793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncwallet.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200027794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncwldapp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syneos.benefitsaccess.ehr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syneos.gsgcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synhronisation04.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synslabs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synwalletsdapp.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200027801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syqvuirowl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syrktitapk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systemsynchronise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systemverification2023.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systemverification2023.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syuseyheba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syyfvgztoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syykpnjopz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syzjbmfepw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szeptextil.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200027811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szg2ro.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szgizxaaji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szgjnpubwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szhirbesmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szhqqnbvwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szjrqckfvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sznzuukpml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szoptoirib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpczyfimu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szpwxjjhcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szslptishk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szwkdirmfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szxdyjfzjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szxmcuxnym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t10note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t1note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t2xmzm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t3note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t3note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t5note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t5note.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t7note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t8note.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taanug.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tabybpmmgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tadafresh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tafzvsnfvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tahcxvvjhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taher-mohamed-ahmed-saad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tahfsqplma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tajolqpbiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"takahashi-dental-cl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"takeda-files.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taktgfmixd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"talktalkea.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tambpqmqri.qzysodawater.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200027847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tambunanajaa.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tameferret.build067.wpsandbox.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tanchova.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200027850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tangerine-biscuit-190bef.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taniaexplores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taockrxncq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarchidesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarck-singposst-pvt.de.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200027855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"targumic-tent.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarsmrztbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tarzanstudio.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tastytreatsnow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavebeulahservices.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavuuoljud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tavuwmhidu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tax-financial-irs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taxinfo.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taxjdfbfuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taybtueojo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taymgvczxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taywqtnfbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tb.x4qk.abruzzo-food.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200027869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tb915hdh89.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200027870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbaahgghju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbaiulxfdf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbblcjapdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbbrlbvgyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbereqsxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbga.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200027876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbgairmffg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbhcmqrmme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbhnegfhmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbieymjfre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbinjmmvlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbnjcofpyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbpyqqvjxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbqgakhteg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbrigqpxcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbthvrseof.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbv265743bv7.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tbwudmxatx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tby.eb-sites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcaconnect.ac-page.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcctwznhix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcdfcscprf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcdnbtilta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcegvkkdtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcezzukbgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcfcypdray.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tchcfswrmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcjtguzifo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcmjwthiuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcnsmdqdux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcoe.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200027901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcqpefnjum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcszdpbxhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tctmobroup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcvatqcuqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcvoifxawv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcwwmyvrcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tczdopwwkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdaghtsfcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdbfmwbmev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdhpbmdoib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdlsnwrjcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdoftpfdlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdpccxawep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdpemplvvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200027917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsszxopyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdtkzlreib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdtwrxrlzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdvbetmunk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdwjswehya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdxinsurance.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdyvoxzpwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdzjqbayhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdzsfikvda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teabuddys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamgoogle125590.psee.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200027928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teammelonhead.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tebapit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tebkzygulo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tebxxgmrsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techlens.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200027933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techniair.ma"; content:"Host"; http_header; classtype:attempted-recon; sid:200027934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"technocareindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"technomedics.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200027936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teckph.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecmachine.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200027938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecnominproductos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teekitstorage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teenmg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tehacarrasa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tehtievtxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teihsbzbho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tejiyglfvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teknikelotoyedekparca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teknob.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200027947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tel-ararmindnotifyestra-bce5db.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200027948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tele-0002.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telecommunication34.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tell.loseair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200027952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tellmeliu.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telstra-823a7434e49e.intercom-clicks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"templat65sldh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"temporaldeadprospect.s4ntandeersa2.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200027956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"temporary-url.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenngfmjlu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teoyudgnsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teqformyil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terjalapakkz.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200027961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terpelsicumple.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.gogodimsum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.lonase.sn"; content:"Host"; http_header; classtype:attempted-recon; sid:200027964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.staypoland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.webclient4.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200027966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test2.blackzdesignz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"testingmir.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200027968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"testletanticsdanaplan.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tetfydxbya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teu.cracow.edu.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200027971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"texasfreedomrun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"texbafor.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200027973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfatayvaag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfiwbwlonn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfiztxzpzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfkbymtvah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfmldozssu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfnxposgbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfocijtuxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfoeuocisr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfogsichqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfolxovocy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfulekpbkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfwwthylrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfxrqfkaiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfyacivrhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfysfjjzyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tfzjheacir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200027990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg0c4r4p3an6fj1nhu6oa6fb95d57kruqle7v2fdefe779r02n8f840.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200027991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgcmex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200027992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgerycfpss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tggbiblyoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgioqoeite.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgjtopycyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgjurombtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgkcljbaoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgmurfmzim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200027999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgnjhnvoub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgnorkbkkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgrmastermind.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgryumxfoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgrzqirgec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgsrihgeup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgtdikmbli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgujbhzxon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tguudfixsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgvlogjzon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgywwjhdxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgzfwpqiba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgzgfetdgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgzhwhotdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tha-office06.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thdlwjwtay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thdpbhgibo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"the-arenaa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecollaband.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecreationentertainments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecrytpchain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedailymoneytips.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedallescollision.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedefiantsnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedigitalshrubs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedindalin.mom"; content:"Host"; http_header; classtype:attempted-recon; sid:200028025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedreamstudio.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedrinkersnepal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thegametimefirm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thegivinggallery.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theglowconference.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thegoda.wl-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehillslc.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200028032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themarketprof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themettaworkshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themichaelleeband.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thensow.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200028036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theology.seramporecollege.ac.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theopenseanft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepretacoutureshow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thepromiseofbitcoinafrica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesmartnetworld.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thespace.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200028042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thetrackway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thetruthapothecary.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theufa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thezerks.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thfcpnelcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thfozmmmdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thgsritlcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thgvvnyihx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thgyzglerh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thinhanphatco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thjhlqfomd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thjiansukl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thmduenkhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thmnhforoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thnjkbckjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thoixvdwxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tholjddxed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thongtacconghanoi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thornyruddyuser.lmnaseloin.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thqh52td5dg45kcykkavf4csdy2rot2avu3hviyvdawye-ipfs-cf--ipfs-com.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200028062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thqudrjatk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"three-retail-live.devicetradein.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-lake3b1.yzqquix4.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-paper-b06a.kimupson47353.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-wildflower-4625.roundcubeupdateq.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thruf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thwsupjxbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thyvnmmqpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thyyumtmgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tibobxwvho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiburontest.icertified.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiedxpgpbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tienbpqszf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tienqmpdkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tifxgzmdpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tighqqfqad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-cell-853d.whybed6896573.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-salad-f8b7.sdk-ppd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-star-e3d4.chayton-amante.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tigmjhjiza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tijgjxbmsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tikfiwbxjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilidplfns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilmnofdil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilqswqncb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"timeforvision.s3.eu-central-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"timzinepuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiopbxcxbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tipografieonline.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiqodjagnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tirkavelti.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tirnanognewbridge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"titraco.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tivrvcielk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tivsdpfuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiyarasz.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200028098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjaxdrcxuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjbaagxdiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjbufgdxxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjdgkuamns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjfqolnqyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjgtnjstlz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjguugolub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjiikublok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjkxjcnepy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjlmqdqlug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjmbuqkuse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjopgfxxig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjoqdpvngm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjtpicigss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjvrdbfvjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjwzydionc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjysxmhbcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tjzzedjyua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkbtqskoiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkbumcjzio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkecwrodal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkelctfhct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkhrljwpah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkiwfmmaya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkjb2019.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkjiipslxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkkqcfyvye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tklvfzrvvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkqiadayha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tksmxmflzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkssnxinsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkvksmekpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkwevgcfbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkxrajcmxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkyqptlkdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkyvlrlzsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlaokzenpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlatx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlcbcp.pe-home.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlebcgxxnv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlfrneszmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlhsupyach.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tliigfdxwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlilcswfxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tliwadsznj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tljjlorqgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlnjloonux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlorrhngxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlrryojufv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlveargkoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlydajyvpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlzagywhde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmcclftafn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmjaycuarh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmkgvgxwls.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmkknlmss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmklgcmvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmmsvztcnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmnaupybpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmndnbboqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmnsmagbbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmodesatbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmudeurrzr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmuqrralfd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmvsjyuurj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmxgehjfds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tmzcdepfld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnbeekbgwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnelicoyeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnfabdxxnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tngamrddax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tngbuozspu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnhjxlfrrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tniffcvoxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnifgshmac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnijurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnmokejtcp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnnhdvblgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnntrbghkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnrustwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnukucomgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnulidgirg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnvlyxemom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnwxwlimvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tnxmvefobs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"to-ken.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tobantukisa.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tobyinboise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tocoezrxwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"todamssaos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toddler-town.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"todjkhpxma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toeoqefvtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tofgvvvnmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokemigration-upgrade.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200028193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokenannex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokenbsc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokenfixit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokenmax.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokensync-node.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tolbdempln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tolzbyvzzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tondive.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toodtfqgcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tool.dinsad.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topbonusleon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topskills.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topstocksolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"torccolborrachas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"torneopepsico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"touch-daft.ie.review-property.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"touch-media.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toursbangla.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tovaolbjot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"towerf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"towerresearch.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"towncountryimplement.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toyotacarseries.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpbuehnjpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpbumlycjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpdmcjvgtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpezdzbwqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tphdckighk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpioxcsmid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpkfzeemjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpkkbzekwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpkuoqksze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpnoqxxscv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpoagltgfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpqoqhbqgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpsrmjhmpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tptaudjhlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tptyrcwzzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpuhhhzmsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpuvxljbwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpvohwrvdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpyhwduafh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpyuinhmqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tpztxmslku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqaaggyins.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqdohlndly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqfsmpimma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqjiqtalin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqoqfyuwoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqqsebwkdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqtwysayqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tquokgkcoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqvcwycgir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqvndrcuxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqxotdyaoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tqybxmkeie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-10083.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-10083.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-20934.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-20934.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-fs.i5bm.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id2892.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7027.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7297.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id7297.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8063.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8982.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id8982.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-redeliver.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-redeliver.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track.usps.delivered-z993765102uwx.theartiste.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200028266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackerc.osend.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackgroups.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking-correos.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking.flowii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackingpending.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackuse.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200028272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackyourorder.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trade-iq-option-2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trade.dydx.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200028275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trader.uniocean.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradingbbex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trailtire-auth-0ffice365-company.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol0001.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol0002.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol0006.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tramacol123.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trams.mot.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200028283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transaccionalcreditospagos.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transacciones-sucursal-personas.neocities.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transaccionpersona1z.sucursal11one.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transaccionsza.personaj.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transfer-wisea.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200028288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transfer24.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transferencia.retenida.viabcp.pe.mibody.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200028290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transitioncap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"translatorinfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transnetsporterminal.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transportal.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trasfigurables.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trasfigurables.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travelvisit-mexico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travelweek21232.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travlamp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trbggbtlih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trcxjltokr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tremondremese.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tremondremese.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trendy-shoes.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trfnpuydqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trgwsquzye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trhgkj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribelio.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200028308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribratanewsbondowoso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribufin.co.zw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribunbalikpapan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tricolrsasar.tricolorprueba.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"triverse.mint-nft.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trivians.pancakeswin.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200028314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trixwrjexp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trjyufxkff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trmbkvbhmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trmjimxzni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trnustwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tronlliink.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tronusd789.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tronusd85.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200028322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trpouvggjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trqcayxpsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trsqzpvbub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trtlbhhety.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trtyugfdfghjjhgfdf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tructpade.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truegrip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truesec.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200028330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trulynolen.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truplay.premint.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200028332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-axieinfinity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-bondly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-magiccraft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truspad-polkadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpad-event.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpadclaim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpadx.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustwallettop.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustwallot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"truuftodbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trvyamdwdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trx-refund.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trya673434.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts.hust.edu.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsbtgomjfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsbzhjvsop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsdzgqneqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tseczfmccb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tseeuyrmzf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tseuwubtxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsfmghxfaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsgbegjruu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsgueqtbua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsitrucking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsjhuuqoef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tslipdxzcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsllcawukc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsme.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsqlwlnwoq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tssbbsgrdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tstapegjna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsvdydpcbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tsvydcvnpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tswihooaeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tszapukbqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttatithorritati.podcastheritage.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttbswmstht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttcjfeszrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttcswap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200028371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttdgjszfjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tthoysckpa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttkflamdue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttlafxgsyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttnmdfkunq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttodgiplne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttorleldyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttsmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tttbvcdixy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttuafnxckp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttuuxqtupq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttwqcfblzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttxgmukyuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttxiamqvxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttxrkhuokk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttzhoqupdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuannes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tubbycatsnft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tubellaesteticaduepuntozero.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200028390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tubytfcbvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tucgxrpdzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tucwskvxcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudearngxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudhuwqxao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudnft.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200028396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudsxdaccb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tudusajsjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuevbqvhov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuewm003.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugclcokow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugnjdfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuilsuka.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuiniytldy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tukkfnluhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tukofertas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200028407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tullrbfxhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tummhujfah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tumnngwnhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tumotcujcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuncapi103847383hdhfnka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuncapi93847383geionka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuneahyt1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap0004683748finaka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap12yhinak97434.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap84683hunjan743.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecap9589384384atomiana.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi008443943hunka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi1008443943miakn.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi1043943diankata.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi1043943miakn.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapi957343943hunka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapin746378.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapina985393tunkia1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapina9853jnahihf81.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapkianhjf847394ta.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapo4873492kina.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecappi9384383utnduanaka.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaii13.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajhg5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajhg9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajj3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajqq7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajtt10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchajzz6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchakk4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchali15.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchalk14.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchall8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchanh1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaqq5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchauy2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchawk12.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptchaww11.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecapu95839483dian.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunescapt8473843.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200028447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuolbcazpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuoqabdaec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqdbtjqvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqslcunyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqya1616taa.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turkeyonlinevisas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turkiyedetehsil.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turkmenulastirma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turqnktggf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"turstwallet.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tustudio.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200028458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuteladipartimento.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutelarestrizone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutor.iqsademo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutoringbud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuvhehjufq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuy778kio09.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuy7a6w71.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyainiciarcarlo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyaritagua.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyarvadsghdfdg.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyatargetone.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyensourcingsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyzbkmyhv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuzncutpzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvduwbfuhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvgkfmoklw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvhasmdycu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvhlosnpfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvkcimrpyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvklyhxftj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvlqavzwov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvlrlpqafk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvmqmqfavt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvqilrpoxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvtftcgssa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvtndzxily.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvvbrvncbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvwpublvqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvxzumzvqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tw-post.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200028488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twabwfysiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twarmzuyyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twbxdgqnet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twdaxyqhrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twdcmmjlnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twhhzdhixj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twibucbity.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilig.semangatpuasaaa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilight-heart-6678.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilight.recomfiermsite.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitch-bonus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twitterhelp-exclusive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twoyzrwpfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twozlqxwsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twsfvcdwvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twumensgzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twvagmzxxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twwypfgdus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twycdqqafa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txctbsfedi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txdmifnjat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txdwmumpwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txfluuzfjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txfyalndnl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txhansahcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txkhabbwjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txqynlxjdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txttzjhyvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txuzpcyiyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txwsvksihs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txxrcthtsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"txxurhbaan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyaco402.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyaprtlahsbj.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyccqgtzqh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyciyjtxgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyfhvsjfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tygrfiqeen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyhnb.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyivjakhqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyjlfevjhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyktdg.daviplanta.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tymajirofj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"typicallynews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyqubazghb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyrrbggapb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tysjicwzeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tysuwqrwxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tywjjexlma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tywkboscqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzabjrciyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzadjkjdvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzdmfxrtay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzesqtdevr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzfoqfhrwl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzhtjtbmac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzjfrhcpel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzlikucixy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzlvexrwpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzmbvppdtq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzoieonviu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzosojgnxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzslwpejzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzudlfmxaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzuwihfxeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzvludjrmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tzwlelbekp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u09hjggogoopgpg-g98g-0h-0h-0h-0h9huihg.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u14511627.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1742042.cp.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1795490.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1798029.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1800091.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1800332.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1805116.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1805525.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u18741649.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u28133312.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u3vii.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u8xdqs.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaanalvrcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uabkbkbnxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaddfdkckb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaeaajlhsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaeubzbxdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uafvdarmjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uagofjmalp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uagpclxsbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uagzjjjwpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uajyjjkryi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uallvxilcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uapuwwjyel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uat-new.wcv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uauclwvkna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uavspuwpjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uayjxmssll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uayppriivb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uaywmvzlal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubangr-scure-grnet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubangr-scure-grnet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubavrzmjba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uberiovo.hr"; content:"Host"; http_header; classtype:attempted-recon; sid:200028590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubfbmryofg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubfkwlehgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubgpwmagox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubmobzvkfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubohzmvkwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubpapfuhwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubuhwzvbyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubvxtwdlra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubxcmypnuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ubydtupeqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucbonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucfkmsdoqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucfqsreqlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucgriadugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucjvawjktw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uckdweoied.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uckwekscih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uconn-edu-online.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucorforrvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucrrrijtyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucrzhuquin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uctdjclxif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucuconmicoa.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucufgflcde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucwlstjlhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucwxsqscjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucxkcjfscr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucyjafyqac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucymssfhpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczmqsrupw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczqlhkqrg.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uczxogfafe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udawqlclir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udgchswsze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udhbbockwu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udiimyhjkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udlvoxysay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udmappbaev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udmfoxobrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udnieiqzev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udnmjhpzng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udpfdxcplp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udrvoltaxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udswbbtkfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udtqcomlpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udwacwgwye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udwbdwnsvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueasozbpbg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uebmuxbxfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueejwublov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uegfwquyyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uegkronjwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uehoazvodq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueiwbzwheq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uejpazepgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uekzajrjzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueqogcmlmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uerztgljke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uetxqmsuue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueurieghsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uexgxefvrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueyjjhwsma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ueylefegkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uezcncxmzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufaiawrycn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufcwrxalti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufdhpsijll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uffyyqkkih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufhmlivauk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufiaqmvkey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufiwzqkpiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufndjbmxgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufnttsfjtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufosalienblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufpalgwhpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufpjgfgsui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufpxjysxzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufqeqckxzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufsdvfjmpc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftkxkkaza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftoken.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufver.omoism.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufvewpljgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufwmnohmvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ufyvngzfgr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugacfahlce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugbiyrhfni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugcqvlbcfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugelshyjux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugexfhudzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugfssbgten.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ughnxdvnhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugjwbayfpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugllefudus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uglmiaqnmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugnjscijld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugnvwkfsrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugok.fessing.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugusfrxjsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugxoytseet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugyftdraq.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200028691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhdbzteyde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhfdwvuhbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhhyqcqaic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhidzvsnrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhjeghvore.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhkirbeuou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhpcvtafkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhtaudnruz.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uhtcleqemb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uibnvaavjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uibui-ndnid-insinos.solifapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uicmtxmvfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uidhntfysq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uieoctjcca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uifogzicli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uihakagtjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uihgajlgux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uijieklbhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uijkamozgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uikwhuppie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uilvdczpxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uipconkjtw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uisvthdbur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uitbfxripp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uitpdohbap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiurkkyvwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uixcuxzwqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uiycqernbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uizqrxfdyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uizrxbvmed.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujfccwdphk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujgcavitwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujh-e3jr5g-wkev-hwer-vjn-wrjv-jrvrvrv-9809-u-09-i.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujmbjqqbjw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujnsdfnsfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujpljyqeec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujrlpbeeht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujsxgaemxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujuzeqrvti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujwetqiazt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujwuylnoak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-bills-rebate.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-bills-rebate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-energy-bill.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-energy-bill.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-energy-rebate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-evri-reschedule.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-evri-reschedule.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk.shein.us-spin.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200028740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukabuftxcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukaobdlbak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukbdqtqpze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukcukitsvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukdvmuvmac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukgwhgsrbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uklrdpisae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukmhrweidk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukngumjbws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukraineconsulatelib.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukrffrnixq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uksxbroijv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukteepvzao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uktgzocokn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukwnieiqsp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukxvvddolb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulbyouygyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uldrqgjwro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uleemkvdjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uletyvsrxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulgoxcxjyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulgroup.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200028762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulicmgsvcc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulillzomih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulkfttpdxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulnlqrcpaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulntcvreki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulouarodpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulpqhffaaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulrzpslldo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ultaeghdxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulthsltzqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ultraluxrestoration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulttxuohje.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uluknbyxuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulybtlzjli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulyvplbarg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulyvxywdzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ulzqgxjvgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umbmikfubb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ume.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200028781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umeqcbxpny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umfewdzfmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umioipdhrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umjnohifao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ummqlbhzzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umnjemkjpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umqmostfaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umtcsoqqvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umtjwvadxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umu.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200028791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umuruzczto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umwoqyqada.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umztgnwxwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umzxyfbagk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"un1cef.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"un231m71wy.toutterroir.ma#.ahr0chm6ly9zmy5hbwf6b25hd3muy29tl2fwcgzvcmvzdf91zi9mmty2mzu3njuznte0n3g4nde3nzuznjawmdi5oduzmdavy21lbnqtchitawxpbmctzw1hawxpbmcty29sy28uahrtbcnmb3jty29udeb1bmlslmno"; content:"Host"; http_header; classtype:attempted-recon; sid:200028797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unaamelnic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unam.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unawareseagreenconfig.asdaasf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uncic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uncucaipyh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"undergroundbats.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"undines.lt"; content:"Host"; http_header; classtype:attempted-recon; sid:200028804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"undximevqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uneedparts.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200028806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unenergy.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unfortunateturbodebuggers.confirmarrrrrrr.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unfsfqadtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unhtogmbqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unhwbzbdvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniassessoria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200028812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unicrdiumu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unicreditaustria.ucs.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unioncredidesarrollo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unionheightsresidental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unionn.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniparhml.audixpress.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200028818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unisonsouthayr.org.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-event.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.openwallet.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.samvitello.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.token.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200028825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.umidao.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.v2.testnet.pulsechain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswapfinancing.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200028829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswaplr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswapv3.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200028831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitary.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitedsolutions.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200028833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"universalsharefiles.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unjardinideal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unjknlphfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unlockaccountblocked.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unlvilkiuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unmttosbti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unojapano.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unpruned-shells.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unrifled-harpoon.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unrusmkzgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unrxytldyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unsqfxbewr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unsub.listhandlr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unwelcomecompatiblecompiler.054webccpanell.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unwkxjgliz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unwwccdxmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoadbqnvud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uobpkfzgom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoijtwtfhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoiomufvze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoppof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uortpazhuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uosmatwawo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uotyncqhle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uoxyhabxjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uozcefsmyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"up5283773-298.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"up5283773-298.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbearin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upceshop.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200028863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update-filedoc.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update-push.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatefil-doc.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateinformation2022.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatemygpsdevice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatenorway-bankid-souf16130.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatepayment.anondns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatess.cfzijxcsp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatetrack.albestrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateuserid.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200028874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatevoda-billing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatinfouspssalert.cloudns.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200028876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updbqaxmti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updhatmlyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updhlfsnjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updykglghp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upevrrdkcl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upjdvplxhc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upload1docportal.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uploadfile-doc.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uploads.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200028885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upohrcfueh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ups-serviceupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upservday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upsourcemedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upsservistrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upttvkgcuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upwpdjjlwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upyooofhsh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqauvmazwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqdvnksben.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqgcefbatv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqhjaqbapc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqjarrwvjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqkiniqvds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqkstgukgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqmrnxvjci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqmxzxuswp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqnaoxnrth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqscitisba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqtkybvvzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqutwqekxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqwktjxrhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqynzyoufg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqypyvwmif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqywxpghcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqzvarimwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urahabhpki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urapgwktyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbancleansynergy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbanfitapp.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urbxmpchdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urdboceuly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urfzaddllx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uri.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200028919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urixlmnivx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.fti.or.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200028921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.xcode.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200028922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url7455.city-monitor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urlbper.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urli.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200028925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urlo.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200028926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urloajuttz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urmskvhldi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urnic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urnvmjafmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urrfdwiega.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urtigocolmbumbajiehfuerhfqe.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urtmhutmmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urubydgeph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urvgcikjwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urwecjmdag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urwngqetsg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urxsgfsoqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urxsybzwwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urxwlmiqro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-brooksrun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-central1-nimble-button-363012.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-decoded-battery-359205.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-diesel-practice-355319.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-fine-blueprint-359703.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east4-clean-algebra-356021.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-post.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200028947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-vsspuc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-west4-mercurial-idiom-334123.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usaabank-alerts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usanotemyprcelsupdates-bc9a66.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usashedulemyaddressupdate-bc2024.ingress-daribow.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usatreasurydept.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uscodbhejj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uscuvhakxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdfninmxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-ethdefi.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200028957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-finance.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200028958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-pos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt1003.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt666.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200028961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdtaky.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdtbsc888.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"use-5gnow.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200028964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usedcrypto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uselessradiantuserinterface.rebaking403.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200028966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-mtb01.hufeer.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200028967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-olivierclemot.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-pudgypen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200028969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userboitevocalweb.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userinformationstoreupdatesmail.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200028971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"users.tpg.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200028972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usersupportv1.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200028973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usgligsfrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ushcffjhjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ushuvjfoxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usikudivpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uslwrmlkha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usmefbjxek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usportal-shippingauth.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200028980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps-deliveryupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps.secure-2e.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200028982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspscanadalines-bc7ec5.ingress-bonde.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspscity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsdeliverycheck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsdeliveryupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspseshot2.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200028987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsinformationupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsrequesting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsshippingauthentication.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspssls.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspssuccess.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsudatedelivery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsusa-expres-bca085.ingress-florina.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200028994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usqhustsji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usqyvlzeqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ussposti.caecf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200028997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ussppss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200028998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usvfeywmse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200028999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uswfmijybh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uswglybgqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utctspvggr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utdwyhmsyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utgkaucuia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utgsfxplko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uthjzkziyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uthkmauzsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uthmvodtfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uthrupemea.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utilizabas.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200029010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utixsxvmlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utmfgexbcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utnbrhufpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utoabdjvcn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utoygghdyg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utrbdstre.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utrosasjao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utwluyplxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"utzllzwzbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uucawbybqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uucorbhyqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uudjjafucb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uufwnsnkmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uugxhhpczf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uugzlxuqyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuhejipcwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuiqzcclvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuiwjnhyip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uulntzjjxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uulznhshnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uupfmlfipk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuvuejktzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuwhwokmiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uuycplddmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uv09s6357.riggearf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvafrozmxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvanifjqmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvanjkewbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uverdnes.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvexdnrjyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvfcexkrqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvkgrccbrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvkxpunzwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvldteopbm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvmovxcfhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvnwabslso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvodvtyenz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvpmbcmimm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvtafowtsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvvxovihkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvwghhvqzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvxdprfgwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvxjmbofoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvydzkgyvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvyiytirte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uvzijadine.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwalcegeuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwcrcugpsz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwdfgucgxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwgdaowhod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwhjdtuawf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwiimdmwvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwijjaasxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwkkfvoebl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwlkuavhnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwmcfbwyix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwnhuseajy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwnnhcoeuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwpanxmdup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwpxfmezys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwqrwlbrhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwrtfpqarx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwsltmkcct.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwuvlexsvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uwvarwwfxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxaqzarvhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxcjwpwxzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxdznyncem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxgkbmizmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxiliwmzxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxmifllgob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxpsiqjdni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxqxgkflfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxrsgyvvgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxs8ti.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxwhwkuvup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyamsnsgtt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyataandrrellosvb.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyataoveolandsdfadf.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uydcejnnsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uydnlydgxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyeiezbqit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyfbbspqqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygjzxbqwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uygxidxfoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyhlqbdalm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyipfzfprb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyjrreyzrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uymqwvwoeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uymxvhuvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyranbqrkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uysterjcrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uytaportameniuheufasdf.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uytppdopbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uytrertyufghgf.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyupamvbiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyupkgxpcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyuropgymds.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyxihisiwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyxydwxywg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyykxotufw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzaudedzfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzbbv-dyaaa-aaaad-qds5a-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzcayuwe.sol201d.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200029114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzdoyzk2.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200029115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzdykmshkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzestrmeqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzgotwqdal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzlqukpekv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzpsczvwtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzqkgsbczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzrfyrwzye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzulclnqan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzuzrzgeva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzvasozvpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzvxkujmhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzwrcvzgoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzxijkmigi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzycuymttn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzysiqomqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uzzbwgaoog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v1and1-ionos-info-2hyeo.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200029132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v1claims.publicvm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v3e0rpohgjv-0wrjh-vjwmr-vj-ewrhnvb-0wnhsd-vcnr-v.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200029134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v5office365-owa6878.microsoftdynamics.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v7qji0.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200029136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaaoahtfas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaaobujqjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vabsnlsmdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vahitzcmow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vahmkvveij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaibvcksza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200029142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.chashanchu09.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicaceessaivcveaririccrasoria.viiessvaaciococvsaoeaosesseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200029362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.3nm.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200029402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.gzj5016.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200029475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.sblr003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcceaririccrasoria.viiessvaaciraoecivraoeaosonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200029880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200029990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200029998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200029999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yaoniuniu5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xiugmt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xx66ss12.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.07ygvz.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.vfycdg.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.wbvgpc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tdodow.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.viglwu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.aajinrong805.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.vfnocj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200030840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.sszpgu.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xkye1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xmfqad.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xtslink.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200030904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zklgse.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.5-febtlapvfuwhlvqn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200030928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kuaiweichongwu22.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200030987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200030992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200030999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zhangyichao1995.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fsecbj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kbkwgp.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ochamf.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bwbril.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.metatv.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200031291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rqdfon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0h539n.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0nwxs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.0s0oy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.1ncp3l.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.2h4j6m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.2t1jl0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.4sji2i.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.6b3qxy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.6ltgw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.76-u-zqw1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.77ma30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.8sy2b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.abm9v2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.adorui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.aftnvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ajarg5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.axuxfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.b1ufnm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.b9asf8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bohc7y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cvhvjn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dlfylt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dpbjba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dpdndt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dqavbn.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ecabki.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ehlcnb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.elnvon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.evrzoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ewnywn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.foj40c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fqcmlink.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200031409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ftibzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fwpkjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gbbxdr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ghdbbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gt0hs9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.gzj7008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.h80drs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.hizwrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ikipon.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.irllcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.isgqms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.itmoow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ivkxun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jdftpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jdjubw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jfiogo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jkuxmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jlvnfj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.jnkapd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kfssyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kgetic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ki6lhg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kjtxzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kmflyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kq202a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ktyebr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kulxbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.kvmh9r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lbvhv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lsztbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.lxpinv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ndiuxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nfygxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nnicqa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nolj49.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nqrkii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nxuiqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.o5irm9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.oepcxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.oinm8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.okywvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pgofap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pgwcxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.phpump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pibfhc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pojxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.pubxgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.puwcxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qcjlrf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qfi2r.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qlzblp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qmzrde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.qzqnfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ratasc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rbvlpb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rgpivj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rgxcoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rqdauw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.rxcevr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sdqqgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.sgl2h3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.suqluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.svgsxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.syd58.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.syzzhh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tcsctj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tgylpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.tkdwso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.trtszi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.u3xxum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uinty.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.uwmcgk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.vcwpsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.w10auy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.whfpks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xbwkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xizobr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xxwtku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ybvasb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yjdcrw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ylibav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yo4xv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yomghd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.ywcjpn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.z4zj8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.zhhula.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.zynepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaingloomydisassembler.daviplatvali.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200031517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecicaaccrirasoiar.viessvacraooaccnirvaoneoseaosesonseosiren.xmdjsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaacarirsio.arvisevseacccooavsaoreosnnaosesonseosiren.wyisqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaaccrirasoiar.viessvacocooacvnaroeonsnaosesonseosiren.nhbccs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaisceecivaaccrirasoiar.viessvacocooacvnaroeonsnaosesonseosiren.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacarirsio.arvisevsaacrcooavsnaroeonsnaosesonseosiren.odiuwn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacarirsio.arvisevsaccovooasaoerosnnaosesonseosiren.sde4rq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.lx7ctk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscsecicaacsriri.ovarisveascccvsooaaoeorsnmaosesonseosiren.ohkgcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaaccrirasoiar.viessvacraooaecnirvaoneoseaosesonseosiren.nzmoa6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaacvrircaosari.veissacrvooaeanircrcnaoeeosaosesonseosiren.9gbi0w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecicaacvrircaosari.veissacrvooaeanircrcnaoeeosaosesonseosiren.mjexdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.76-u-kkj18.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.9i8e85.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecisaacvrircaosari.veissvcoeooaacncrvaoneoseaosesonseosiren.finamv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiscvecivaaccrirasoiar.viessvacoeooacvnaroeonsnaosesonseosiren.ssjeoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaiwfrgkcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valenciaoptometry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valeriagames.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valiahorat.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200031537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validacionbancaonline.josiwd.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200031538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validacionpichincha.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validaritaupy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200031540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validation-sfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validatuinformacionbancaria.laseguri23.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200031542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valkonp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valkyriestaking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valleymech-auth-0ffice365-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200031545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vallianiaerodetail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"van-bussel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"van-holds-dietary-menu.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vanillagift.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200031549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vanillagift.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaoqaxbvtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vapeexpress.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200031552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaprjrtofm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vapylscmph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaqtebfrgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaqwopbivp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"variabletomatoprintablecharacter.bilinea1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200031557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"varundeep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vasjdjbasmdas.sdfvsdfsdfdf.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200031559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vawdzinnvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vawipvlkez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vaxfg5.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200031562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vayfkvypir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vazsubnkdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vb86idjjzhx.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbcaqrhoyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbdmreaact.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbehdfkgd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbglvappfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbkbnqjswl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vblk34hlk.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200031571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbmoihbxfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbnmew.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbogghebyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbqimwlcec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbrvxhvjhq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbugquxpdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbwfptusan.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbxisnusil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbyjsfjnzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vbyvxqtpvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vc-107510.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcapumkihk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcbftagnhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcbujmnvpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcbyxmqudb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vccpocafqx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcexqzzzcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcgnfqwyim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vchoqtaeic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcjcekamab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vckvobotjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vclluhoucj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcncbedrco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcockixcgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcuxtukqcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcwhfdckqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcyrerfrko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vd.vnipqpz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdbnj.2kk2950.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfbf.75237.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdff.ansrmyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdfnxoleup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdgdbbsqpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdhb.tech-stell.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdlpeamlsx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdpwmsweih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vds.dabluai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200031608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdtwjmxqua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdumhbxubl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdwtylqcjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdwvllkyih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ve0r9gv-ewjr5h9g0-4hnw-0rnfv-0wernfvnw-0nf.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veadodtnwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vebi.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200031615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vebqlsgakm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vedmhhkjef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veendanrug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veetjuorfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehdryguhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200031620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehicletax.service.gov.uk.0vy3lpjix.persyar.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200031621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehiculingbleu.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200031622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vehr045fgj-wrjefv-jwer-vghnjw-erjnv-wj9-vvrf.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200031623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceeesacveirccrasoria.viiessvaaciococvinsaoeosnmer.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccairscri.orvaisvieascaccivsoioaoeosnmer.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccairscri.orvaisvieaseaccivsoioaoeosnmer.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicesevaccciracrsior.avisievsaaacircovsiniaoeosnmer.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevecacasiricr.voriasvaiecsvasciiooaoeosnmer.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veicevecacasiricr.voriasvaiecsvasciiooaoeosnmer.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceveeacseirvcrcaorsai.vieissavcioeoacincvraoeosnmer.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiceveeacseirvcrcaorsai.vieissavcioeoacincvraoeosnmer.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200031698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.5uzz0h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.650pt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.b6x80w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.dnmsu6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.lgwjlm.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200031778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.cjezmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ogzbtb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.shanchuta27.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.com-deals.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.klgmfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ph29h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200031925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.457e0p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.7lnki4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.b32mgr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200031980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.nr5kfh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200031987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qfvbqx.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200031997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200031999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.rjbvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.awsgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tfodbq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.cstztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.5sime.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.chashanchu48.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.flscly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ihfo5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.notwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ofldnb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pjt9os.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.wolvps.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ytnxwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.6mmfl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.b4eqf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.cqvlsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.hycxop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kuaiweichongwu14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.llsoxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.puoo9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qoefmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.u25r5u.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bs7dc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bsnpag.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.doenfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kbqnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kfpxyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kpgvbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.n21so.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ptrwmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qvcxln.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.3p1yb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fzfweo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gs3do.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.hyhznq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ioxsho.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.iytxjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ladyul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mwdrbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nfpdgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rgdpsh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.runjin007.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vcgsip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.2sae6k.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.3dbbmp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.4-4-j-nbbn-ct.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.7hml9e.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.abluwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.adlxbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.afohvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.bfsngf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.bvdadv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.cdpthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.citcfi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.coxrdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dfdnsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dgqqxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.djulad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.dkmimw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.eaelbi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ehgmml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ejvocy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.epwnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.eucvbc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fhqemq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fprrlq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fukjzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fvkhnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gdmdxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.glhdpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gntozh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gtqklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gxdhfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gyzt809.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hhxulg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hpbzkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.hweypy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.iaklie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jivdhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jryuds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.jubsfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.kutlzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.lfvlpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mbirgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mingrunfuzhuang05.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mvqlzn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.mxeanv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.n6eonm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nhewlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nkjfmc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nlujo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.nqsaby.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ohzctx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.oiknia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.oipful.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.patcfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pbykwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pdndft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pqdxev.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pugxbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxbkkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxnctk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pxzjwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.pysitg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qexccc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qlmenm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rhwdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.royjjy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.rvpepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.saveyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.sftqjs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tbntv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tgmqlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.tikoig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.uhia8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.usivdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vcacks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vnbbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.voadax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.vrbvro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wcpjfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.wwffoj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xaexmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xgjt.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200032728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xgtofb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xqpwkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.xzlnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yhuvzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yphurc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.ytwbnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zmlyhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zrbfzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zxj6002.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vekboggclu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vektrofoods.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veludoukkw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"venhwxnzug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"venusclaim.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200032746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veoveo.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200032747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vepllionkm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veqcfwdmuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veqpnsurcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ver-2ji.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200032751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veranope.wwwaz1-ss44.a2hosted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vercredhiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verdvhwdqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veredicto63.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200032755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce001.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce0010.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce0010.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce005.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce006.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce009.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verif-idce009.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifca-dati.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifiacountbof.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200032773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifica-2022.dedyn.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200032774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifica-ora-procedura.solifapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificacontosospenso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificadatiweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificaportaleaccesso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificarestrizione.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification.espace-particuliers.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification.fb-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200032783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationaco.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200032784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationeminent.eminent58.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200032785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmessage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200032786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmetamask.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200032787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verified.b0aamerica.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200032788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifiedownlpro.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifieprofil2022.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifieprofil2022.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-account-co-id.webnode.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200032792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-anda0011.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-anda13.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-facebook0022.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun2011.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-identitas-acc0unt-c0m-id.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200032797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-meta-account.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-pengamanan-akun.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-postingan-anda2022-2023.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasiidentitas2022.webnode.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200032801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasipeemblokiran.webnode.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200032802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifnowmeta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-3mtb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-banca6.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-email-e8a07.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-email-e8a07.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-pembatalann.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200032808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifychase.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifydevice-uk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifydevice-uk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifyid99847736628293000044.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200032812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veriifyac.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verlogfly.flywheelsites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verrpxhgxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verrsiimiigiiggratteconiitech.homes"; content:"Host"; http_header; classtype:attempted-recon; sid:200032816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verskmyxcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versomsercp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versomsercp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versuomc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versuomc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verylneaspromos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vesgtxhtny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vesuarmpsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vesynkxtlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vetrafurniture.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vetrilsoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veuiunfnon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vewrbvger9t5g-hwrehgbn-0wherfg-0hwef-0hwqefef.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfax-gstdr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfax-gstdr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200032831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfbuubwqwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfccxgrppl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfdbf.jyxkypk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200032834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfgdh.gbdszyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200032835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfhobdedlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfjbbmcvxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vflqeggelj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfmirtloud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfmkurgnuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfnbyfogdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfraqvhpne.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfrstrst.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200032843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfrwvtvzva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfsmubydbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfszwuuwlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfvqkzahwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfxulfxxjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfyarpidpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vg2b4r2htaj8qc5mgq81qku11jt3ganu0trs2k0p8d6un4djesd3e3g.web3portal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200032850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgcsufrail.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgdvqhhhpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgicintvpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vglqopswvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgmxvewdfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgndqar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgoyqminha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgpgucpyoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgqueayprk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgtggzavfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgzkswqzmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vgzsdvtjvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhaiimfxsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhdlhmlgjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhee.o6cc.cfgliders.com."; content:"Host"; http_header; classtype:attempted-recon; sid:200032865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhhaughvvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhknfstqgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhmuwijzxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhnuppoirq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhozjusqum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhpplfedhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhrkvuomsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhrwhicntf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhubcdnaco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhwiyzojhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhwmnpedre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhyokxkece.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vhytzbkqlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200032878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200032964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200032965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.p8ween.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200032983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200032989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200032996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200032998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200032999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaaveesevcesei.vivcacsveersaoir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesavceei.vivcsvcesairaser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaeveesvcceei.vivacscversrai.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaevsccvcrasoia.viessvacraoecnivrsiori.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaevsccvcrasoia.viessvacraoecnivrsiori.nfxuax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.obhybt.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200033681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavceesevcesei.visvacsveerasoir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.snyurh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200033936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200033968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200033980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200033983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200033997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200033998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200033999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaavseevceei.vivcsvescair.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaievecsevrcaosai.veissvcoeoacncvrsiori.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200034309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavasevcesei.vivcasveesacoiras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.htjgex.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.liwsft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavcseevceei.visvsveacsir.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200034643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesavceei.visvsvceasiraser.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveceesvcceei.visavscverarsi.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200034894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200034925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200034940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaaveseevacei.vivsvesicaserr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavesvccasri.ovaisveaseccvsoionrri.bwlepb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200034979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200034988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200034997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200034999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.shanchuta01.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.znegsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaavsveecei.vivsvesicr.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viabcp.web-prestsmopersonal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200035136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viabrasilaventura.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200035137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaaeeeicecrei.viavaecrrasvccoieai.o4elaa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacaseeeicsceei.viaceraersvacrocierai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viacsevcesei.visvasvceeaso.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.1efm15.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.aborate.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200035448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaecesvcsceei.viasavesvcoerra.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseccai.vivccvcveaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaeevseceeai.vivccvceaaaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.abbgir.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevasvcceei.vivacsvercsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200035821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200035884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200035914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200035927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200035945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevesvcsceei.viavacesvcoerrs.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200035956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200035999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevsecai.vivcvcvaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaevseeeai.vivcvcaaaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaecai.vicvcvecveaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaieevscaeeeai.vcivcevceaaaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaeeesvi.cvsceveeaaavis.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaiesvccaevsvi.vcscveeveavsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaecai.vivcvcveaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaievsaeeeai.vivcvceaaaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaeeesvi.vscveeaaavs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaisvcaevsvi.vscveveavs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vialbcp-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200036906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocenure.visoresiercmsvi.lmdmaum.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocure.visorcsiercmsvi.hmamatm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiocure.visorcsiercmsvi.hynvkvn.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianioorcecure.visorcoecssiercmsvi.fuivkxa.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianiorcecure.visorcoecssvxarercmsvi.dtgskgr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vianocenure.visoresiercvxarevi.eaplgjq.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200036912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasecviioenrem.vsosirvsismscvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.eaezlo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.egrhtq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesciooiwzxrem.vsosirvsenismcvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviioenrem.vsosirvsismsivi.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.gyyiwk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseescviiooiwzxrem.vsosirvsenismsivi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.eaezlo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscoiwzxrem.vsosieovensismsivi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioerscznrem.vsosieovsismsivi.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.mqvjkr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcviioscoiwzxrem.vsosieovensiscvoievi.xqjgyc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.qigfcj.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.uuppfm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.wgkngu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.yvzlne.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200036979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200036999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevceceesvi.vsccveeaaavsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasevcecvsvi.vsccveveavsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvceeesvi.vscveaaavs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viasvcevsvi.vscvevavs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.10-0uuylvdpatiqzcrok.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.xvdju.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200037509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavcasevcesei.visvasveeascoiras.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveaaevecrei.viavcrrvcoiea.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.beijinghb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mgzntc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.wefhbs.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viaveacesvcsceei.viasavesvoerrcasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavecesvcasi.visvireaccvsior.ulyjlf.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200037675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavesvcasi.visveaccvsior.qu5z38t.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200037676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2sfjp1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.l1ldvy.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200037754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200037761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200037791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200037804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200037832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viavsavceei.vivcsvecsaias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200037833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viazdkwwmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200037834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibadjtaxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200037835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibhfggkmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200037836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibramwyprzedaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibrawav.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.kqfoqs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.srlqyc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicavisacnnurueszovvseon.escazsmevoiursi.tfwvbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viccaaeeaicverei.viavaecrvasaccoiaei.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200037862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"victorarath99.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200037863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.befurr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicucavisnoaaueovseon.visazciesnureeinsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciaccnaovuvseon.visazcmcieseeainsi.uiiavd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.cluemm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciacnnuesuzovvseon.visaczesevsiosi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacuaeovvseon.viscecsmireainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.aeaaij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cbxspx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lwbpzn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacucaeovseon.visceisureeinsi.rijenl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.bjrlsn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.drvpxu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavinsacunureszovveon.cessazciursi.qgispn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisaccaeovvseon.visecmiureainsi.tzzwdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciavisacnureszovvseon.esazcmevsioriursi.usoqts.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200037999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.khaylv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.laguer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacncaouseon.visazcmiceesenainsi.zzwuas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.aiczsa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.dpfplb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.eytnjs.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.mxphbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiacnnueuovvseon.visazceesenvsioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kamowm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovseon.visaceusenreeinsi.puzdqh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.figdiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hldgqg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ktzhyt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauaeovvseon.viscemseniureainsi.orrpya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.acysue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ccjole.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.cgrfee.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.gwvhgu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ipavwe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcesioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.airnja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ctfaoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.deocmk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.fpyzoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hkieuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.mnalmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.nijizu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.nywlkd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.oaotso.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuciiavnisauureszovvseon.ceasenzcmevsioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.gfrdxv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.hzmmyk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.icqbyi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jhbjti.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jrbyeg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.jvyhkm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaccaneovuvseon.visazcmciusreeainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.inilsf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.nkmpia.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnunresuzovvseon.visaczcsmeevsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiacnureszovvseon.visazcmeevsioriursi.yozdqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dknouc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.dzpmfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.gclajk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.gplcly.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.hsxsye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ilnsyb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.jjtebf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.llfmbd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.noegdn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.odgjer.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaiccnaeouseon.visazcmicueseneainsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.aetzyx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.epdexz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iksnzw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jokoqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.jueaim.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnnureuovvseon.visazccesvsioriursi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaicnureovvseon.visazceenevsioriursi.hyxhne.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.agxyxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.atnpja.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ayvpej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.cqikbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.cxvesz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.dkxwtn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fabbxw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.fwmztl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ibdznx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ipckgf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.isfnre.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lfeyoa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lluhni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.lyydbz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.npxbmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivanureuszovvseon.vsecnaszcmevsioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.cpjomt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.dmgbrn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.etibxf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.fauyqv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.hjoven.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.hsobxm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kadyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.maivih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mcabmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivinsoauaeovvseon.viscacsenmiureainsi.xokvig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaaeovseon.visazienureeinsi.tbtenr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcesioriursi.hjrhmw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiaivisoaureszovvseon.vsenazcmevsioriursi.rtwmgc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.alcdkp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.byguuc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.bznaak.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.dlzdwm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.eegabi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.enksln.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iaowza.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.iazdui.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.itoeyw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.kopnbv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mftcmf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mhxwoz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovseon.viscazsciureeinsi.wzrrqp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.cstvyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ggxtiz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.gvbmgq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kfwoih.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.klngsb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lavnql.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lltgtv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.lryoni.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.ngdpig.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.nzuvrz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.oijbuk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.osoqzr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacucaeovvseon.vicsaszcmiureainsi.pdkuld.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.axhyue.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.bkcywi.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ctsuwx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dohoyv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.dtlrgj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ebaawf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.equmej.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ewhrdc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.frroav.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.hpvzmq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.iqhnep.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kbubhp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kbuhif.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kmuhkc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ludrij.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.nmdzpk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.ohssdh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcesioriursi.okzwyp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.attlqw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bdhjoe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.bxcbkt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dbxmic.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.dlhefx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eiggzc.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.eqfynh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.gubhky.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.hyhijo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.jimkqm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.keiczj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.kvtqsz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mhvcvt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.mrkudt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.oexeuz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuiavisnoacunureszovvseonc.vsisazcmevsioriursi.ohmvcj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ajgwlg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.bangme.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.bfuapo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.cnjzqo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.daxqpj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dbyapt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dgqqzk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.dhitmj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.eugwas.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.fhylla.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.ihytpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.iieddd.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.iivqdq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jbgyvv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.jnvwvr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kcsxhb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kklrfz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kuycqq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kvfyvz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.kyzuqj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.lnhweo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.macpqa.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mfnwca.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mfrfhh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mrezau.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mtedjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.mxfqsm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.nscrlf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.olgmmh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.oudyit.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicuivisonaurueszovvseon.vscenssioriursi.puzdqh.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.fbgnzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.mmcqln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseeeceic.rveivreaaevesi.qboxjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.ksdadl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseevei.cvrieversavesi.osqsyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieececir.evirveiaaevesi.qwudnh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.lrtzrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcresseieveic.rveivresiavesi.plqjhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseeeceic.eivreaaevesi.pvhngq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.bjexfe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseevei.cveversavesi.lenorv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieececievirveiaaevesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.cjysqjj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecresseieveic.eivresiavesi.upuphone.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200038386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.elhicw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.jdqomw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseeecei.vivraevesi.tqmskg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.ssrpsl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseevei.vivervesi.xaeuyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseieecei.viriaaevesi.tomorrowstduio.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.jtuet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.tqmskg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.ttxupv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcsecseievei.vivriavesi.zblgxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.nyapck.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.uktqmo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseeecei.vivreaaevesi.xioxfp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.iezkxp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.obnjjr.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.pilzbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.vtihba.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseevei.viversavesi.wssjge.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.flydpf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseieecei.virveiaaevesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.nlutye.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.nyapck.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvcseievei.vivresiavesi.ygrkwy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicveaeaaverei.viavcrvacoiae.gzj5019.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.cbargn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceiveci.vivrseiaveesi.pilzbq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.qigckf.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.qyoqyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.stghfe.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.vucabx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceivei.vivsresivesi.ygrkwy.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.ifpdph.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.sbonjn.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsceveci.vivsreaveesi.vixxvg.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvscevei.vivsersvesi.ymixml.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.jfmfyj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivecic.rveivrseiaveesi.plqjhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.lwxxqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseivei.cvrievsresivesi.neidee.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.exrjwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecseveci.cvrievsreaveesi.poaixv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.kxcepn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsrecsevei.vcirvesersvesi.oycpxz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.wdtsjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceiveci.vivriaveesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecceveci.vivsrveesi.ajvrm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.bdbbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.cpgspk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvsseccevei.vivseresi.yanwen.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200038440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.mkpiab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivecic.eivrseiaveesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.dlnxzo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.msiesya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseivei.cvevsresivesi.xvtayq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecseveci.cvevsreaveesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200038447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.ckhnlk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.dafenghao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.vozep.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicvssecrecsevei.vciesersvesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"videoair.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidfjjdsnedjsia21981923.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidhyaclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidiooaj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200038456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vidioooa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200038457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinceiecure.visorcorcnsvsmeercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinneiure.visorevsirnnermmvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinoeircenure.visorronecsmsenercmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreicenure.visorerencssmxarenercmsvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanioinreie.visorcvsienrrnmmvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieanocinueire.visoresievrcnenvmaevi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieasecivioenre.vsosirvsivmenscevoiei.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescoiwzxrem.sosieeovevnsenismsivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviioescznrem.vsoieovvesenismsivi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscviiosoiwzxrem.vssieoveensvisencvoievi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisiooiwzrem.vsosirvenviseenmcvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.dwxrym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviioenem.vsosirvvenismesivi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaaesi.visecevvasseaors.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaaesi.visecevvasseaors.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecaaaosi.visaecevvssaosr.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceaeroi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaaaevier.vecevvasceveroi.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceaeroi.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceveroi.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaeaevier.vcaasceveroi.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecsaesvier.vasacsveoir.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaves.visaecevvnseier.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaaves.visaecevvnseier.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaees.viscaasneeire.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaes.visaeansaier.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200038715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viecvaeaes.visaeansaier.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecaevier.vccavceaeoi.puowqu.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200038717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieisecsvier.vasvceveoi.lyjtug.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200038718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneaie.hmfhsq.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200038719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneaie.lq0cebn.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200038720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaees.visccaaneeie.gmveprp.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200038721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.lqslas.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200038722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieivsaaes.visaeaneaie.xvaunoh.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200038723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieniocineei.visorcsievrcrnnvxmrvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.fxfbld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.hihmof.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kdhnlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoereinseinv.vsoersroivrenenvmaevi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ftnnvo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinceisnv.vsoersvrornnirmsvi.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ikjthi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.njaczc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinoeircecsnv.vsoerronecsmrenirescvi.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.neagfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreicecsnv.vsoersrencsrmxarenerescvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.dy1nam.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kgflqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinreiceosnv.vsoersrencsvmonirescvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.djtela.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.gpik9c.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.kkvrke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.tbsfgl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.xahccw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoesrinseinv.vsoersvioerinrmsvi.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dgckut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.hnyrvh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.icbupe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ileuct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.jvzxml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.passoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.xqvlbl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zqlmyv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinviaesnsiea.vocasccvoenucveoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.aenjkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.fwgrbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.msiobh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.oubbeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnowzxera.vocacvcoeenensunvi.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.akgjcb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.bmknvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.dlhsif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.fviult.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.mleksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.ontgpj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.p0mou1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.p7251j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.pcukoi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.timuyw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisaoesnsera.vocavscncosuenvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.buzmri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.erqvhz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.jyszpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.kosoht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.mtdqmc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.rlaptr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.tutpfb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ywcuuj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisasnoiwxera.vocascoevnseenucvoiei.ywzeqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.flgapj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jfqejr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.lcq3yk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.luiyci.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ndkuwx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.obmxjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.veuqdd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesncoiwzxera.vcaseoecenvosenucvoiei.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.a8m6di.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.aaxbpo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.erkzgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.iobrjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.llpgun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.oshfrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.pazzro.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.qyaudr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.rlrkoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.sk6y3y.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.vnhemj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.wfgyvk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscoiwzxeravocaseeovceennosunvi.zllcxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.adpslp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.agdhkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.bhqnyq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.dnoftm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ejvyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ewhdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.iyfkny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ljnqqs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.tpwghl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.wgrfay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.xgnrrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaoesnrscziera.voasveoeencosunvi.ynaecg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.baelbg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.bkwgho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.doxryd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200038998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.efcgly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200038999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.gy8u8m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.hstoja.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jashxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.joziry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.jvquad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.keud7w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.laojhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.lxszsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.msphzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.oxfasj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.p31bj2.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.pasytj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.rwuluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.slstjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.vghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.zdealp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieoinvisxaonsrcziera.vocaeocvoesenucvoiei.zxizqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieosreinneiv.vsoersioivrrennvxmrvi.avghrha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceaesi.visccavseaos.xotcze.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceasi.visaevseaos.5y4gj2a.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200039019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesaceosi.visavvseaos.dovxqw.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200039020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viesctsbenk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vietgahp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-flies.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-power-share-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-power-share-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200039026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view.campanhasbradesco.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200039027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.au2mo1.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.au3mo0.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.au4mo2.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.ax7in6.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewsnet.jp.ax7in9.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewthescreen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vighgrurbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vigowojlzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihgljmhco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-delivery.3921548455.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-market.054218455.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viirtualconfi.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vijomitpsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vijwbukvde.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vikinghalden.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200039042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vikzlqihnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vilaperros60.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vilztboabu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vimstzxgql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vimted.7645184512.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viniocure.visorcsiercvxarevi.eaplgjq.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viniocure.visorcsiercvxarevi.vtwwkwu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-dksf.order9451.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200039050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-dostawa-pl5444.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200039051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-market.6921548455.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-merchandise.5554315455.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.15a2.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.39sf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.5mimi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.8qjk.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.9shot.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.adyga.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.anoth.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.apriori.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.asndh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.baqia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.bbrtf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.bewept.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.bg24.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.bogel.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.calang.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cangmao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cnuanhk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.couraegis.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cpzj8.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.csapps.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cvbvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cxarv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.cxdswz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.datais.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.datuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.dddac.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.dundu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.edinar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.eiyao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.enenlu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.enqtran.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.enses.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.fynet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.fyund.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.gagal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.geekv.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.giavang.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.goow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.hbsoic.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.helpix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.hentia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.homew.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.iamhindu.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.intuigiay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ivnuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.java9.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jayapkr.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jayeola.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.joust.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jstatic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jsuwx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jswlkj.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.jualjual.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.klambi.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.kohase.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ladyred.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.lagump3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.lajiao3.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.langjiu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.linhu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.linkhay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.maytao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.mbc1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.merakian.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.migi1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.mohong.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.muqing.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ngoaihanganh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nivdal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nmgaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nrs10.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.nzyoga.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.opivity.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.pdfan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.prosumer.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.pumehc.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.qiexi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.quanluo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.quexi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.quotify.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200039133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.rensaba.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.rongta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.sao6.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.sbiq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.serori.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.snapnue.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.starpro.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.stocker.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.stroka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.suut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.synchro.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tduk.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tezahn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tfmok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.timgai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.trudlet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tuihak.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.tukule.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.ujeqt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.vg3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.viewsy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.vuilam.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.wallsite.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.wizb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.wppress.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.xj23.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.xurong.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.yokka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.zalukaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.zcrypt.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gj32d.zihu1.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-gkk219.geekv.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-id002c.anzijie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-id002c.canam.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200039167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-pl-lzlxo.lanyard.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.ahay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.arhiles.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.auther.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.bbsxt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.cnuanhk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.cunmao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.dgfdg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.dshsy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.duyute.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.hycdgx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.jdrcw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.kangke.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.mecztv.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.mnmlst.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200039182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.muviet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.navia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.pagode.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.pasar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.poas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.puaman.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.raytyz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.timun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.tuatara.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200039191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.vyborg.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200039192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.winlin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.zanda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-polska-rr124.zooqle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-purchase.570324.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted-shop.44125.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200039197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.62154986451.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.bdimonet.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.enpin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.sprzedaz.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200039201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.tel"; content:"Host"; http_header; classtype:attempted-recon; sid:200039202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedform-dispatch.365719.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedinfo-shipment.564348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vintedstoreinfo.30541222.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinterd-polsk16dellvst.went-dostawagetpey092.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinterd-polsk787dellfs.dostawaspaingets5.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200039207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinterd-polsk851dellfs.nessdostawapoland013.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200039208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.ctuhgfk.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioerescsnv.vsoersroirevxarevi.nulhvqm.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesreorceosnv.vsoersoecsioirescvi.iuwqqxo.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresorcecsnv.vsoersoecsroirescvi.vtwwkwu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioesresrcecsnv.vsoersoecsrvxarerescvi.qmvhsgu.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.hilrzx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.jlxkma.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvaoesnsiera.vocasccosucvoiei.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.bypiqw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.khlzjd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.mhlvfi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.podujg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.xutdbc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.yabztv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.zcyttz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnoiwzxera.vocasccoensunvi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.eickib.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.gpaqia.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.hbzhrq.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.mbjhhd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssaoesnsiera.vocasccosunvi.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ciuwoo.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.fjfuni.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.ovpzzh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnscoiwzxera.vocaseocenosucvoiei.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.gykmlg.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.hqnjab.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.jvahcx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.ksbgin.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.mifikv.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.ntdght.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.pdzcxc.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.pvqbdr.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.wfzola.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.zuaswx.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.arowal.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.bomgwz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.jqlcwt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.nbzllz.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.rqrpjt.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.sfqlok.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.upblku.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaoesnsrscziera.vocaseocosunvi.whdeeh.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.accunn.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.cmoqdm.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.lndzay.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.lyiqnd.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.rdinpk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ukpvop.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.xkpjpw.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vioinvssxaonsrscziera.vocaseocosucvoiei.ziehxi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200039290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"violetmermaid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viosreosnv.vsoersioirevxarevi.hymzwrr.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200039292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vipfbtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viqggrjzst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viqzlfnvsd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralhaha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viralmelayuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbqapb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbstgpb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtualnetbrasil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200039300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virvlxtpzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200039301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vis-stort.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200039302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.edziyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.evyqhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaeveeccsvcrcaorsai.vieissacirvoeainicrcivsioir.gyzt808.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaaevesccvccrasoria.viiessvaciraoecinivrsiiori.p8qjo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaaievescveccrasoria.viiessvacioeocvinsiroiri.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiceesiver.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsoiesiver.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200039333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoiceeesiver.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visacsvoieesiver.oea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaeavcececsvrcasii.viiorsaervesaiccvnsiovreri.mylnsr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaesccaiceer.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaessccaivr.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieer.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevccasieveer.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcscoeissiver.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevcsoissiver.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevececsvcarsi.viisvioreaeccvssiornveri.ryygdq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevescseiver.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevessiver.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevscecvcasri.viisvaiorecevsisornveri.mzzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsceoeissiver.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvcsoeissiver.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesceseiver.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaevvesseiver.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200039731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaicesiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasoccaieiver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoieeesiver.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200039972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200039999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visasvccaoiesiver.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasceissiver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavcccasossiver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccasceiver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaveccassver.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesicveer.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavesiver.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiceveer.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.cckrka.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200040348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavevsiveer.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseissiver.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccacseoeissiver.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseiver.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visavvccaeseseiver.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaeaeier.vacaasaeoir.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visccaevier.vaevaasoir.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaaaeier.vaecevvasveoir.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaeaeier.vacaasveoir.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viscvaevier.vasvavsoir.lxbnlm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccaaeier.vaccacaeoi.iehamba.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200040638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseccavier.vaevcaeoi.opulwar.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200040639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visectsbenk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseioscai.vscsaieeicso.stjjjj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visescai.vscsaeeiso.qxkahc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseseoieoccai.vsscessoaceeuiosscoc.gnpais.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visioal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visionawebapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visioncenterss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200040646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visionts.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200040647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visitmadeira.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200040648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveasececvcccarsri.viiisvioraiaercvissiioirnveri.fshxqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveieececsvcecrarsi.iviisiorviaeoccisvsioirnveri.jxavqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissveieececsvcecrarsi.iviisiorviaeoccisvsioirnveri.usyxh3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaaeeesccvccrasoria.viiessvaciraoccinivrsiiori.djkvdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaeesevccascri.orvaisvieascccivsoioinrrii.ojvntr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvaieeescveccrasoria.viiessvaciococvinsiroiri.bsvdfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveaeaverrei.vivacrvecoisec.gzj8007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visveascecvccarsi.viisvioraaercvssiiornveri.slx8h.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvceccasir.visivaciorvseiorsnveri.string97.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200040673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevaccvncvsa.viveseevcavrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200040764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevcvcnvsa.vivsvcveeenavci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200040861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssavccacsevi.vieveeevacrvnvsa.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200040961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200040992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvccasevi.vivevceevnavsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200040994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200040999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvssvcsrccasevi.vivevaseroceevnavsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.herbertweb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200041055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200041057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvaccvecnvci.vieveecaaarsenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.mjdnpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200041150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.xztftf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvsvcvcenvci.vivcaaeeseanvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vital1.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vitale-informations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viurfxmtrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200041235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viuulqjwnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200041236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaaeesccvcrasoia.viessvacraoccnivrsiori.swixid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaeesvccasri.ovaisveascccvsoionrri.ouswzc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaeesvccasri.ovaisveascccvsoionrri.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaescvcasi.visvaraccivsior.mu1iskm5.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200041240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivaiesvccearsio.avisevsaccovosinorri.eqmmzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivasevccasir.voiasvaecsvscioornri.zxj4029.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavaesevai.sa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveaecsevai.saaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcaveescvai.saa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcavesvai.s.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaaaes.visvecevvasaier.likduf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.ebltts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivccaeaes.visvcaasaier.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200041305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevacreasecvai.saoaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaevecrsavaci.soaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceavareasecvai.sao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivceaversavaci.so.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dvqses.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200041440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.pvebll.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200041471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.upfi.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200041497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsavceei.visvsvecasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.pfkndl.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcseecei.viveaaevesi.vusnur.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.wylftw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsevei.vivesavesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.fthjtm.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.nskxef.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ryogde.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.yjnkya.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.ylvgii.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsieecei.viveiaaevesi.zenagx.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.mgfxpv.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.pxwxmw.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsievei.vivesiavesi.yoltyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.fjdayb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.lqonrt.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.ojabvb.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesecei.vcirveeaaevesi.pruuwp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.hcnqqk.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreesvei.vicvreesavesi.peqrlu.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200041535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.fbgnzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreiseecei.cvrieveiaaevesi.mzrkkc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsreisevei.vcirveesiavesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcsseceecei.viveaaesi.mhnved.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.lrtzrp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecevei.vivesavi.poaixv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecieecei.viveievesi.fiwzrb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecievei.vivesiesi.kxcepn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.cntxao.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.digitize.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.vfchrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesecei.vcieeaaevesi.yanwen.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200041548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreesvei.vicvesavesi.upuphone.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.wbvazy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcssecreiseecei.cveveiaaevesi.xaeuyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaaes.visvecevvaseier.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaaes.visvsecevveser.ftrdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivcvaeaes.visvcaaseier.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.aamuhb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.charlang.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200041638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200041668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.scmfkh.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200041677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.syzyzz.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivecasvcceei.visavsvercasias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevaarvasecvsi.eao.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevavrsavsci.eo.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveaacrvasecvsi.eaoaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200041776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveeveavcrsavsci.eoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvccai.vivscvcveaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viveevsvceeai.vivcsvceaaaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivesavsrei.vivervcsie.zxj6008.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200041980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.francis.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200041990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200041993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaavsevsi.ea.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200041999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200042000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200042020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.cairaoke.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200042065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.hlsyku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevacvncvsa.vivesvcvrenvci.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaeavcsevsi.eaaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200042121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.owens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200042127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevaevscvsi.eaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200042136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevavsvsi.e.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lcazit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvcsrnvsa.vivsvcveaseronvci.zoyqhl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200042185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200042199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.oppxsj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qnqwcs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200042218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevcvnvsa.vivsvcvenvci.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsvcai.vivsvcvaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivevsveeai.vivsvcaaaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscavcai.vicvsvecveaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivieevscaveeai.vcivsevceaaaeii.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaieesvi.cvsaeveeaasvis.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viviesvccaivsvi.vcsaveevesvsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsavcai.vivsvcveaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivievsaveeai.vivsvceaaaei.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200042999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaieesvi.vsaveeaasvs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivisvcaivsvi.vsavevesvs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivosaaeeei.viccrvcooier.wndxgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsocieesesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200043193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.vnbmwi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200043196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacsoiesesia.o.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoceieesesia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsacvsoieesesia.oea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacceoissesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccacsissesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaecesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaesesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceoissesia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccavceseoissesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavccaveesesia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesceesia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavesesia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavvesceeesia.cea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsavveseesia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.fyyfxo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.qyoqyz.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsciveci.vivseiaveesi.xioxfp.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.iktggq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscreisveci.vcirveseiaveesi.rjfbqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.apoljj.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevseci.vicvrseeaveesi.sewril.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.ntmdlo.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscrevsei.vivcsreesvesi.ylvgii.za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200043842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200043866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoceesesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsccaoisesia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.jtuet.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.rsfcmb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisveci.vcieseiaveesi.sejmqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.mqiwux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.runjin004.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecreisvei.vicveesivesi.wetot.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200043973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.wgipfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.wxnyfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevseci.vicveeaveesi.xxdjik.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.bspybm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.craycraft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.tvdoqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200043979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscsecrevsei.vivcsesvesi.zliboyp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200043999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeesesia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvccasoeieesesia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavccseoissesia.c.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavcsoissesia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavecsesesia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavessesia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcceseoissesia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvcseoissesia.oea.xuacoo.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvecesesesia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseavvesesesia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseaasi.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200044212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.nvjdhuei.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcarvaaecsei.aao.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevciceesvi.vscaveeaasvsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcicvsvi.vsacvevesvsi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.2021071.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.ebwptg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.robertson.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevcvraaseci.ao.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.lhzfkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.tvxkmp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecacrvaaecsei.aaoaa.zbvvpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.tvrimx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsevecvcraaseci.aoaa.zeyeds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecaiecsn.viscaieaeeivsei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecaieosn.visceieaeeivsei.cyrvcc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsiecioesn.visecaeeeivsei.cyrvcc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.037768888861.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.473glv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.6t1vk7.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.krjqpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcacsevi.vievevcrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.33hf19.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.aogild.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.cmudlt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.cwpgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.hefhjq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nllyoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.9zv0ny.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.jehe99.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nqveqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nu57wl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.ukrtxd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.uxvqzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvcasevi.vivevcvnvsa.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.afqzgx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.bucyvo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dbhlbm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.e7ie6j.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.eahbrm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.j3tu3m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.juls8q.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.k9pn0d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.kvrhdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.nv9dtw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.ojyzcd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.q0s2sm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.uixah3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vads.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200044651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivssvccsrasevi.vivevcvaseronvsa.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.kb5b6d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ljmuov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lmheln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.okbpku.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.qeaogd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.srcwhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.srwwap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ukesvp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.uxdgpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.vvkdlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wfirhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.witojr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvaccsrvecnvci.vievcaseroaarsenvs.yybtfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2ebz23.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2fx3p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2uz8yl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.2z6dpf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.4-4-j-tyu-uyt.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.4vul30.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.5xvtv1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.6j449d.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.6nc5p5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.7wqxmz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.87qi6p.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.aalme.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ajkqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.anl7ya.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.axcgpp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.axrdkh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.bokqmt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.botom1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cdfsiejkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cdsqma.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cjxmoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ctokrs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cxusvt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.cyqggi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dgmeec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.drlbyz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dtyweh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.dzerdf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.eaoapx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ebmedia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ebqzws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ekqclm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.eoamsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.evcinc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fhalul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fjmcxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.fph186.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gmgjkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gulbul.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gxemzv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gyzt802.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj5012.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj7001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.gzj7009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hcoklg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hgpqys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hlsmyl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hvjagp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hwzwtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.hxsbie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ia4myc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.iiyqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ijowbb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ioxzyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ioyatz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.iuruyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ixk0s.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.j68gux.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jdqnac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jhuejd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jrignr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jrzx77.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.k43e5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.khbsvn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kkohnd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.klvjnr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kpygtz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kqstye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kwlzjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.kxdnjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lcacsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lgn09m.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lmhau8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lnuxfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.lurojy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mbruzw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.metabrain.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200044795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mivflz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mwsxcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.mzbqid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nbdgwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ncatge.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nfffte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.njhpgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.nljqmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.noqaub.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ohmatb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.opyxhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.orhznj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.osnolv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ozmubm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.pctmqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.piicje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ppvlmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.prthkn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.q04nkf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qlxmyy666.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qmjded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qogdsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rataxm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rbqvre.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.realme.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200044825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rewvsa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rojykc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rolling37.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.rsnhxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ruesxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr001.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr005.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr007.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sblr009.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sd2ed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sgnqqe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sgrxpw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.shanchu02.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200044838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.sl86as.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.slbggp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tbktyg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tdenvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tgytgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tmwhe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tvvghs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.txqqzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.uabtme.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.udhdcl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ukqtgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.umkykk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.utshxs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.v8vbdk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.verse6.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vkzvur.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.voezvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vr0rx.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vspuhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vtcgqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.wcidvq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.xgyaef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.ykjclz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zlsrwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zwddtp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacei.vivsvcesias.zxj4025.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200044869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.9pw3lv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.adldni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ansklx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.bwxsxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.cgogay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ctdwug.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.d5u49w.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.drkild.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.enioab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.hmziti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200044889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ka83cb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.lfyacu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ll64vg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.pzgoea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qpchzg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.rmgomo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.syeuaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.tl86n6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.upahh5.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.vxcrlo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xydvkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.xyuhnm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200044916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.yvjdgy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvacvecnvci.vievcaarsenvs.zhwpnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.glmbfd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200044923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.shjpxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.xniqmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcavaesei.aa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.fzosfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.ipexqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.jjglsw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.limassol.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200044937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.qzvxui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.riley.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.sqmim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zqjkvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceavcaesei.aaaa.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.alister.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.cjehdm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.fcwh886.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.gafuwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.leigh.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.leonard.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.loskh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.njrksy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.reynolds.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.sinclair.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200044959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.vnxgwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.vordmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xhgmfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcevacsei.aaa.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200044999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcieesvi.vsaveaasvs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcivsvi.vsavevsvs.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.clllbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.hncwbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.jimdyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.lhixak.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.norfolk.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200045156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.npxfcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.oamprk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.ptywgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.rowan.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200045160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.vjlile.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xdaupp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.xulhaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvasei.a.zrxpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.69bn6b.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.7a4s96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.82casa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.aayldm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ajxdpg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ao0dkn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.bxsxvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.hli3b0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200045179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.j77o38.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.k3ma2x.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mcltim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.mfx741.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.or1glf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.pe14pc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.psdexq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.pujapd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.rsxojx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.sthtuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.tazsl1.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.tbnilj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.u0c8sn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.vqeyuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.whnjwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wpzqxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yqasjy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.yuxvpc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvcsrenvci.vivcaasaseroenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.284nxw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.4k2dci.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.687cem.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6c7bza.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6pw2wd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.6rtqht.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.9d24dh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.aale2a.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.dbezzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.dqbdkl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.erkdnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.fn0aqh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.hblfhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.inkblog.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200045219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.kgfkdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.llufip.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lwgayp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.lylxce.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.mgjpjr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.nrhpkc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.psdoni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qclqjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qqjjzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.qvgavp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.rbyycn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.sawjbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.slnb02.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.to5fb9.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vdpgwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.vspjok.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.werbdt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wmygyx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wsojbg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.wxpckc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xd1bpn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xeygaj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.xgysxo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.ymifv0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zhsntm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcvenvci.vivcaasenvs.zovh96.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveccascesia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveiasecsn.viscaiescvsvei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsveiscesn.visacscevsvei.yetbrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvsscecaseia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaeseeesia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvvccaesesia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivzcsbglo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vixxbmkqfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjanajwyon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjbwxqdtzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjcybkazpe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjgkvtabxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjgqeciktr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjhvkh-rt09gu-t6y9g-0e-gfvertgne-rtjng9-etrnhjgeww.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjipbkbxjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjjfqojvha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjkejpfpoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnfciqivv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted-merchandise.34333289.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted-pl-ijfoks.liweijie.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted-purchase.8987656778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted-shipment.5788876.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted.4912541215.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnted.6594521.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnteq-dostawvapolska512.dostawaipln004.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200045591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjnxqtvzgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjoafmcenz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjplgaxjkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjpyldhliu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjqlutvaxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjrslnrkfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjshwqcjnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjsxtwpziv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vjtjaecsvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkcwmpwawp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkdhqulrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkdmloqgzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkeggueurq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkkvpibuum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vklcjmecxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkmsnmxiod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vknncdrjom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkqmiscroc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vktrymcjvs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vktxpysgqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkxqwxzxfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkypwnplhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkyzzzlzli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlapkxsefl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlaqnoeorp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlbdpllfoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlbmastyqv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlbpo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlesiuljdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlgvactvpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlharlqtbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlneqdlkrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlnted.casff.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200045624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlogkpjzwr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlopdkbswq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlpnmkkhwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlrjcfifnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlvffrdugz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlzkqhtsfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vlzmfutbpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vm-encrypted-d0cs.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vm-encrypted-d0cs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200045633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vm1-encrypted-d0cs.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200045634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmagicqndl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmboxx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmbtrpedoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmcmytihuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmctjgxnak.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmefadpzgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmglpppeow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmgqgvimdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmkkgwbmru.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmldnchkri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmonvmyknz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpelwrzet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpknmfqas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmpswbmxob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmqlestdxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmrcgfzphn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmsypeplko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmtfjoxqpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmtusrybwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnbzjlujgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vncebibmwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vncnaimdxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vndfsfhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnfdhfkj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnhwyjjhjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnikwncojv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnkvbwvlyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnliodnuiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnljqrnznx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnltnjpouu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnmmihhgui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnnxdzfngh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnqhzhlukd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnrjtkyrms.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnrrmdmwjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vntijpulid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnudfaqook.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnvrkgytr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnwcmmkpah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vnyudatdqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vocl-a43eb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200045675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vocsfrpe.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200045676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vodujpdtim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vodzmbdrdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vofgqminou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vogelvetgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vohurhktsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vohxuzokoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemail-refbe4d.sharedfiles-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200045683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemessagejsgd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemessagejsgd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200045685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vojcklwsam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vokagqezzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vokplfjnur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vokvbkmlqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"volvocarskc.us1.list-manage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vomkseihqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voodapvodl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voollixjsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopdrigxe.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopro.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voqamlxoro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voqcaqicra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vorsruszoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"votewhkowq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"votre-site-vocale-orange.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vouchere-astrazeneca.totemsoftware.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200045701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voufddqfrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voyvijbgwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpaixxfdts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpblprugdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpibqpgmzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpiljhpenk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpjavwqfci.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpkncevzba.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpmfwofwzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpp-89g0e-9r-fkw-jvfg-ew9rjmv9-enhjrt-0jnh-9j-0j9.obs.af-south-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vppixnrlhx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vps47975.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpsddowcmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vptxqtdcgp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vputeqqzka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpvmffgadx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpwvbpmikk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpygvvdldb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vpzhmcamec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqccvnaopw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqcewryedf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqdyppvsfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqemj.vailice.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqmuvfvuqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqqukvrmch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqrslgxjpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqsogujifo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqsoquzmdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqwyicrkgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqzakvvtwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vqzwoktcto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vr5zqx.germanpersonnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200045733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vratdzzhiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrbcgysikv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrbigcfdva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrdmovytds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrhpovkirk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrlfpolliq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrlornhslq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vronengineering.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrowdcjuyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrqgcbcuvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrqjwtrnhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrsrpcntfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrtkozyekb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vruvjffozf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrxnuwnkgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vryanfskby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vryxygmzmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200045750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaaeeeicecori.vsaaevcaarsvcroiai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacaseeeicscori.vsaaevcaarsvcrriai.mavbpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaeaei.visacaasaosr.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaccaeaei.visacaasaosr.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacceaaei.visaccasaos.gwoosi.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200045755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacieveceacscevi.viasvarsvcrsrai.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacieveceacscevi.viasvarsvcrsrai.d24mu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaaaei.visaecevvasaosr.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaasi.visavecevvassr.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsacvaesi.visavvaassr.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200045761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieaceaecevi.viascarvcora.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200045762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeaiv.vicacveeveaasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaieivscaeeeiv.vciaceveeaaaais.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200045999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievsecaiv.viaccveveaasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaievseceeiv.viaccveeaaaasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeaiv.viacveveaas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaiivsaeeeiv.viacveeaaaas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseaiv.viacvevaas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaivseeeiv.viacveaaaas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsaosaaseri.vsccaveorir.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaiaeaaceori.vsavcavaeoia.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscaoseaaaeeri.vsaccavaeooair.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicaeevi.viaaescaavsacrorai.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaaeeaicceori.vsaaevcaavsacroiai.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaoseeaacaseri.vsaccavsaerorairi.vaylqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccaseeaicaeeri.vsaccaeavsaaercoairi.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsccieaeeaccaeevi.viascavsacrorai.gjqyzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vscd.zgwbds.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200046527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsdbf.nlabnfa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200046528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsejohorxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsekjrexql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfkjzchii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsfvccapfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsievcasevi.visvavcsr.3pax4.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsioscaeevi.viccavcoorr.1p2igt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsppfwukpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vspwaffkqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsquanvupx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsuepraznx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200046538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoicseavcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsoisavcia.o.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200046571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiceseavcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.jsmfgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvecsvoiseavcia.oea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcscoeiasvcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200046599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevcsoiasvcia.o.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsacsevcia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevsasvcia.a.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsceoeiasvcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.geqnuq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.isvuiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.rgqjka.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.urgggv.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200046658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.vlunrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvcsoeiasvcia.oea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.sorjpe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.tppwpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsacesevcia.cea.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.axrcbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.buavhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsveevvsasevcia.aea.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200046679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesaccavceia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaiceavcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesoccaisvcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvessacscavca.ooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200046990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200046999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveceia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaaveia.aeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieavcia.oeooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvesvccaoieseavcia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasceiasvcia.ooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevcccasoasvcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.azrsog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.nnawmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.wezouj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.wiqlcn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcceia.c.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.mdxbrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.obekup.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200047415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.orcbvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.pkwrdl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.tvbcmo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.xwdvad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsavcia.a.zqawii.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.laoisuej.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msjudi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaacevcia.ooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsccaascia.ooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.kbroxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.nofalw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.uiedwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.ukohwk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceceia.cea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.jfcxph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.kvdxks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.oajqfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.pgdfhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.pmnaeh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.qbcbta.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.svfocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.uarmbh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.xewfoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevsvavceia.aea.zvzqtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.0e0db.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.fpaksix.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.kjdjwuw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsoieuyr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lspxoiu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.ma4k6.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.namkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.olkijsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.qiehao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.v3454.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseiasvcia.oeooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.6f1mf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.baidu123.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.erqer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gsyeuwi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lianges.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.likijs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsklsope.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lskoposi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsoiujds.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.magxoisud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.msjdyf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nhusiwa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.paddki.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.sdaiexswe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tashpitum.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xiksjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccacseoeiasvcia.ceooaesc.yianskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.bsdeio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.csndax.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.d3skoc332.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.gtxdifu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.jssjue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lijhdy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lkosdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsasdfg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsggppe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsloposl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.msodik.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nanish.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.ncjxliskd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.omgg0.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.toutiaohao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tsyudasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.tyroess.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaesevcia.ceooaesc.xzsywte.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asdaeer.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asdueiw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.asjdied.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.b5jsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bahusue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.baudiqq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bfhju.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.bvhjjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.cdiosa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ckfbs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.cocodes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.dayuhao.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.dieowp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ghdes.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gocdr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.gsyeidt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hajsued.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.harginsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hliurkd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hoalside.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.hsyueiod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.huaxianone.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.i1lyb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ixousudy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jhusd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jpisi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jskidoe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.jsodiek.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.kaosid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.koplsig.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ksidujed.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ksudie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.laiisode.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lasdas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lciskdu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lijhdjsu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lingangbcy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200047826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.losijdue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsgsda.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lshosie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsjdhi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lslpoi223.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoidike.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsoieuy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsposie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsqpoisue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsshkly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssncjud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssopdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lssqwe3ly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lsxoisd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.lxiskjde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.maediof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mangesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.margincolor.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mjsudio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mpdskdf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjdud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.msjhdyue.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.mxkusjdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.ncjhdyri.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nhduio.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nishilaji.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nsjdyues.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nsyheuks.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nvmkdi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.nxhgsyd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.pilidu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.plaiksd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.qhjkof.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.qishui3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.recordd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sdwsyde.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sinnod.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.sokdjhre.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.t4gwf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tablegsh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.tiafedf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.trsas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.usideq.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.vajdui.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.vardir.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xiuydw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xlsoida.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xmsjdhf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xmsjude.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xskieus.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xujsioa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xuyhsjd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvevvccasaevcia.aeooaesc.xzkuf.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200047879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscacaiv.vicasveevesasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200047999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvieivscaceeiv.vciaseveeaasais.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievsccaiv.viascvevesasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvievscceeiv.viacsveeaasasi.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsacaiv.viasvevesas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsviivsaceeiv.viasveeaasas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.bkmtxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivscaiv.viasvevsas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.aempvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.aggfpx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.angskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.aovskd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.aycbpv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.bagatn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.baishengwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.buaktq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.bujzts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.byvvoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.chbogc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.chipel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.chvwrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.cknvrx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.crgcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.derttj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.dgcxkf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.dldaen.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.dnytdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.doozbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.eabboz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.edvqan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.eovlfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.fefxfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.feipyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.fihcwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.fqeitb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.fwggea.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.fzctif.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gffhis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gfmdsm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gimbjt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.giyarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gjdfei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gpcaia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.guskko.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.gymkux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.hjxsle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.hviljm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.hyicnl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.ildcfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.iyazyw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.iysyln.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.jfysaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.jgyxok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.jsbwdy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.jwluwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.kbxlax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.kjpzvx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.ktmuae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.kzfgvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.mpenym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.mvvbrc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.mwdkgc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.nbmlys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.oozlqr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.ovnrqc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.pljjmm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.pxibhf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.qbpihx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.qqoehr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.qzswkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.raoxxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.riviwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.rtegfj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.ruqdog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.rzvflv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.shxump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.sjfmje.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.sllzad.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.slruwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.stkfns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.tjqiry.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.tndado.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.tqmagv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.tvwump.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.uclutx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.vuonno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.wkzsav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.wseqrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.wszouq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.xaxoso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.xdfglk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.xdrsxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.xlrepg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.xqajbk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.ydfcqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.yjnxkx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.yjzswj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.yplahe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.yuqfcf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.zbpbhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsvivsceeiv.viasveaasas.zfwkwl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsxqrsldzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsyreudtbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vsywlcpioy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtaywyvixc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtboymtdjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtbyykeher.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtcfqyewyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtcwpoatzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtfxhxrdrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtgmzrfeha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtgukuxboo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtkgaxowfu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtkrtdjnzo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtnrqfonij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtqlewqbql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtttomhwwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtufdchdph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtukvmkeso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtxmail2018.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtxseootnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtzgxwfddx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vub-appsk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vubyxqqqhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vubzbilmoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vudlwtnrzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vugunefmyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuipuazcmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vukbywmzam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vupeysvtce.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuphgavuwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vutcpinsdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vutlphtuqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuvmdpyrkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vuxgwyutyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvallet-palyogn.technology"; content:"Host"; http_header; classtype:attempted-recon; sid:200048671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvanm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvbifdlpew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvbjrlnlzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvbwtkfdqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvdltxiykf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvellfargo.serveftp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvgalicia.vvgalicia.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200048678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvip-mlay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvip-mlayviral.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvip-myid-real.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvjeshmlgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvmetagame.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvmrbbingy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvntechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvpxvuidoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvqkogllhu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvs.sanurvi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvurnrmcng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvv.lnterbamklbenefit-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvvlwxlxoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvvw-bitkub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvwvvzonasegunrapichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvwxkfhbjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvxbzzmosd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvxruxejbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvyyhcsoxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwaqtoakgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwauturpxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwcnblmfxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwcvodcvlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwlfgpirfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwlkrtcnpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwpttgfxnt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwsdwzdbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwtysrfwqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwviwufewo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vww-pancakeswap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200048708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwxjkufvqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwyoxdhybc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vx.wcw3oln.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200048711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxaixn.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxcd.yatpvbn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200048713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxd.igwkrxp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200048714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxdse.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxeilraiqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxfpgqbufu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxhvirunpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxinkjxybn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxletcabyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxqpnsmsul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxtcmgfpli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxvhqiqzmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxwvgdnbpw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxxmbmxogb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxzrmtixhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vydgsazkcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyfwfeqbcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vygcsdsqcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vygnxgflnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyjhmrhwkh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vykgjiteij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyldhuqxqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vylxxqnfmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vynrtxjjgz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vypjqxuqdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyqecvarnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyrwruyfpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vystar.toorassociate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vystarcu.unityclinic.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200048740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vystarcuvrfacc9f6vx.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200048741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyuwdblffq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyxnchsbys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyztdtovtk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vyzyomekia.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzcgtkhoqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzlenppfrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzmljkbduh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzmrxkgmlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzojzymwjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzpeowptsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzqbtkjiyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzrnlwnrwn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzrvkklepe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzsgryjfkerzshbn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzujkqooap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzuwhsucwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzuyyllivy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzxredtgyiqw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzxsrkqgpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vzxvhfds.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w-magiceden-world-app-helo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w-magicedenn-app-worldd.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w.centralized-securefix.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200048764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w.smart-vaultdefence.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200048765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w6eu6w77.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200048766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w782409br247e.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w9eventos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200048769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wade-105024.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200048770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waecsycaoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waefyyhrjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wafda5.vectorguitars.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wafqlorhxe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wagmiunited-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wahed-koudsi2001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200048776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waizao.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wakeful-unique-cartwheel.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200048778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walet.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200048779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walldesign.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200048780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-connect.serveuser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-exodux.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200048782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-mobile.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-web1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-web1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.exodus.com.b02tv.lachnic.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200048786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.near-network.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.near-network.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200048788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.polygon-technology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200048789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletappsolution.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletconnecting.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletconnects.tel"; content:"Host"; http_header; classtype:attempted-recon; sid:200048792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletmodifier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletprotocolserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletreconcile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletremotechecker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallets-update.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200048797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsbridges.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200048798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsecurity.upliftingstar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsupport.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsynchronizer.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallett-orgnear.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvalidation.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200048803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvalidators.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvallidation.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200048805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletwebrectification.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletxodus.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200048807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallstmemmes.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wana78420.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-fire-1c00.jamaljewellerry356.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-frosreg.people-meedia.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-recip.u1r79b1c.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wanegroup.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200048813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wannotableagents.galicia1home.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200048814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waoygpyygu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wapking.com.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200048816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wapkmgumxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wapuzagrfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waqassupplies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"warnertelecomm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"warsa.bandungkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200048821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"washoeir.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200048822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchess.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200048823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchtoearn.sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watils.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200048825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watjclhoua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wauvqdftqt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waves-enterprise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wavneeziqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wawiybudtm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waxhmlxtgs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waxonkeyxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wayuai.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wazowzhssl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbafjnmwbw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbbbcc494.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbbnafmpfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbcixarbql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbdxheanki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbetizsjpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbiruapswt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbiwvcmida.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbiyjjdssu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbjzduvnxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wblewtyspt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbmsqgpyxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbrftwullp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbucthcrrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbuniapaqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbvfvzqgmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wbxltvvmbr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcdsecures.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wceuczyoto.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wceufajpio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcfejsiqgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcgvmnqfgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wchayeyhny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcizwshkec.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcjekrstkj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcjskkepum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wckyajdcpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wclnyhgogi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcmamijlvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnbjtwiam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnclvscyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcnxgcozoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcp.co.il"; content:"Host"; http_header; classtype:attempted-recon; sid:200048867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcqcsorwaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcrswfojhy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcssptelau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcvak2jk3lb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200048871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcvmbrmfuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcwpuxskwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcxomeiofc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcyfmyrgkt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wczrinyobv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdccntjexd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wddjanpwsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdexqviqnz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdfdf-101916.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdfdzfjhsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdffsoyzud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdiqkgzgez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdkipomgjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdmjepdata.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdmtuycvpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wduaaacxgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdweebwuuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wealthy-statuesque-mistake.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200048889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wealx.vailice.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weark.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered-bread02.peoople-media.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered.mnevicionzone.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200048893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-agricole-info.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-curve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app13x.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app13x.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-france-app9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhe-bank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhebank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhebanka-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhebankk-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobank-co-jp.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200048919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobanka-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankb-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankc-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankd-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankg-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankl-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobanko-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankp-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankr-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankss-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobankt-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobanku-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhobenkt-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib-mizuhodank-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib.mizuhabangk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib.mizuhebanik.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200048935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-ib.mizuhobaniki.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-aboutax-japan.mizuhebank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mezuhobank-jp-from.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200048938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephen.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenaes.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenri.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephensane.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenstar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenster.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200048944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephentaher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephentare.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200048946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephentesr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephenthere.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200048949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephentres.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephetenrs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-miizuhabonk-japan-tephetenrs.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200048952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mizuhebank-japan-caonr.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mizuhebank-japan-nacooe.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mizuhebank-japan-rnccs.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mizuhobank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id-mizunhabonk-japan-tephenstre.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200048957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-id.mizuhebank-japan-aboutax.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-mizuhebank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-server-03-19-update-cpanel.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200048963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-viabcp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.bank-mizhuho-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.centraconnect.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200048967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.fixmyerrors.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200048968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.i.d.mizuhebanks.japan-support.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.i.d.mizuhobank.key-kfjer.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.i.d.mizuhobank.key-shejs.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.i.d.mizuhobank.key-urjsr.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.i.d.mlzuhebank.japan-sunday.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200048973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mazuha-bunk-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mi.zuhobank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miazohobonks.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mii.zouhobanki-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuha-bunkweb-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuhabuck-japan-soloman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuhabunk-japan.armstronw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200048980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuhe-bunkes-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuhe-bunks.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miizuho-bunk.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizahibank.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200048984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miziuhobank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.miziuhobank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.co-japanss.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200048987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.japan-confirms.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.japan-cools.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.japan-lives.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.japan-solos.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.japan-updates.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebank.murrays.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebanks.jp-have-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebanks.jp-what-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhebiank-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhibanik.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200048997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhibank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhibankin.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200048999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhobaink-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhobanik-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhobaniki-japan.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200049002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuhoi.bank-japan.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizuihaobank-japan.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200049004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhiback.co.jp.cqaqs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhiback.co.jp.hfxhjj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhiback.co.jp.lflpkl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhiback.co.jp.yfklkp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhibannk.co-jp.xfyike.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ib.mizvhibannk.co-jp.xzxjgg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ibc.mi.zuhiobank-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ibi.mizihabank-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ibi.miziu.hoibank-co-jp.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.ibi.mizui.hobank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mezuhobank.japan-from.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.miizuhabanks.dewea.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.miizuhabanks.dunlox.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.miizuhabanks.nathas.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank-servlet.japan-theres-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank-servlet.japan-withs-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank-servlet.japan-yous-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-abouts.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-afresh.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-aftera.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-ancomes.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-ancomess.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-arlyp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-could.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-goodlife.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-newones.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-newoness.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-nowe.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-other.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-peopel.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-runing.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-theys.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-thinks.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-times.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-times.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-verycool.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-verycools.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-walker.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-walter.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-want.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebank.japan-woulds.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.id.mizuhebanks.japan-cash.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.instantfix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.logodesign.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.mizuh0bank.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.mizuhobanks.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.mlzuhobanks.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200049051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.serv01.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.yahoomail.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.yahoomaill.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.yahooupdate.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web093938-233.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web1-ib-mizuhobankl-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web1.ib.mizuho.banke-go-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web1.your1shopwithxz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web2.1d.mlzuheb.anks-jp-ert.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web2.1d.mlzuheb.anks-jp-yup.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3.1b.mlzuhebank.jp-fly-2022-asd.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3.1d.m1zuhe-b.ank-japan-pur.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3.1d.mlzuhe-bank.jp-fly-2022-ert.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3coi.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3coi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3helpers.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web66.com.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200049068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8610.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200049069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webadapro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webairbnb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webatendimentoagora.dynv6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webaverse-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webbperitalysicurezza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webclient.moreapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webconnectappsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webdappauthorisation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webdappsconnect.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webdatamltrainingdiag842.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webeex.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webelektron.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200049081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webemail-syksang.sang42555.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app14.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webfrance-app9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webi.bi.mizuhibaniki-co-jp.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webib.mizohibank.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-107001.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-109295.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte19.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte27.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-sso8uyg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.attitudecontabilidade.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200049109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.bellahills.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.salemgroups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailadmin0.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailmaster.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200049113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailpt.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmial.constituters.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webs.walletdappfixed.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webseguridadportalbancadavivienda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webservice-mailupdatemail.arqanexportcompany1664.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"websmail.managements.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200049119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webtdwnugj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webvalidator-interface.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webwalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webzonaseguraspichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webzonasenguraspinchincha.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200049124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wecqsajmep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0001.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedadobe0006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wedpahecey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weee-f8bef.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weee-f8bef.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weerizvrra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wegbzmwvgf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weggbvvvna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wegotgoals.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wei34kjhgl.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200049135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weib.ib.mizaihaobank-co-jp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weibo-com.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wejkqndrzh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"welcome-jp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"welcome-jp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weldersfactory.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"well-account.introductionally.webhostingforstudents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsefarqo.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200049143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsfargo.xghklkhggl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsfargowebapp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wellsiifargo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wenpwndeeu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wep3klvbihk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wepaziqcdz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wepbichincka.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200049150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wepcdrefrl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weplays-connect.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200049152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wer34lkhgc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"werare.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200049154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wernvyhxdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"werovckjm3.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wertyuyytrertyuuytrrtyytr.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wervicerh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrock-corp.dongfangfuli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrockcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetalk247channels.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200049161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wethnjcvpp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfers.neptune-ecli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wezjrtjder.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfaovzwbmu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfenejhobi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfmfgjxhvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfpookfufm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfpulghbou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfseidhend.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfsrpusnmj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfzhtz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfzpcnnerb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfzxsaljis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgaerxtlr.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200049177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgaslxcrkf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgbpbqjxpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgdnqshuas.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgerwepram.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgfosddmza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wghzgpldcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgohkdgzou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgooxpefwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgpqlohxnk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgprbcqpmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgtqqfaryx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgufiywnay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgxqbjypyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgytzmjglr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whare.100webspace.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whbubwyoli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whcgoheqpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whdaoecnkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whdmbassig.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"when.loseair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whhyiodiww.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whisbe-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-bonus-05b3.wastemanddd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-field-05e4.kdg6smak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-glitter-ba48.casterweed.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-island-0c892b710.1.azurestaticapps.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whiteangels.co.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200049204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whkmkwwkqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whmtownnki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whnwccsiif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wholesher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whrptbuyjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whsvuqtbxy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whtfyllyxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whvsx.vellit.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whwsadxayr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whykpyuhks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whyvdizazg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiaesfykjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wick3kakc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wickedvicuna.build067.wpsandbox.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widadkamillah.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200049219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widget-dot-lbk-asistente-pre-principal.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widlba.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200049221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiemzhzhjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wihpuripbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiiegsyndc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiijwumsqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wikfoeblbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wilyutfqjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wim7pt.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"windstream-net.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winesonjanesonpublic.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wingofmisadventure.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200049231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winted-purchase.809142.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wintedshop.3265122.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winter-thunder-a1ba.gdjklahdkjsadampie.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiqwchdnyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wireconfirmation68c10a25442a3e13.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wires-business-starter.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200049237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wispy-flower-c715.westemoreland.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wispy-frog-f21d.kbc21bma.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wits-application.active-jobs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiwxfcstge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizardly-tu.62-4-21-217.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200049244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizaytcnka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizcukdcur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wizqxcicoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjadjxobqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjcrtxtfdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjeqyhtgdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjeswvtjzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjfbbcmntn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjfuqpiffd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjipyscpxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjisxxhwpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjkxnifvui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjmmzzzlyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjogkkfqno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjospokzwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjqujqwjac.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjtufbmxek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjwwjwvamm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wjzannzlqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkayjsibdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkazisan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200049265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkbinqhkbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkjhpzpksw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkjnzskjnseka-lbx91xybtf747394.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkknsrvtfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkljpeuliy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkmhziyisx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wknqpzrvxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkokkwddyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkpkuvjoeh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wksuajunlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wktprhfhik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkugvjbakp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkujtvqvbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkzikgmhee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkzrznsvhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlbcpjprpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlgbzwwbwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlkfjahqav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlnimokfrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wloehyjlrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wloipasojy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlriopjnmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlrlcwqbvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlrnbpotxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltcnt08201.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltkqlekpi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltzkvqyfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlukenrace.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlwjopfeur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlyhjysmln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmeyeagdss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmfurgxlbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmhquzjygm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmietjzklm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmjinhjldj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmprunsrrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmqfctjjex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmruafhham.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmtkqgrzqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmuzavbgjp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmwfetlhjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmxcfevndw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmybiyoope.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmyciueyda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wmykdxtfjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wndgwpnlwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wndqdhxlmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnejsfdyek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnetxysdme.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wngekhqlmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wngrvifarn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnkyqcntuf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnnomylxfa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnokjkrmmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnovaahcha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnpwtrezdj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnrdsflvby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wntcpppoul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnubhtlpcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnuuyszzjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnyrpzqqho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnzjieqngu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wnzxkyjkag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woecfzpjaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wohnqlwgrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woixstlhsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woizmjvhth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wolmawmvsl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wonhczhkvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wonijumypd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woodmetalstil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woollutbam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wopeut43lkjh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wopi4kjlvbd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wordpress-849488-2929804.cloudwaysapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workhomeblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workoutwalls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workprotocoles-com.webs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"world-js.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worldbaonlinedc.ddns.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200049345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worldofpepenft.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worried.mefound.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wosgayokyy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wotgopmzem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wotqcegwta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woucfsvsgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woybzuphbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woykhinvoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wozwvbefhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp-login.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp1sl706.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpacdvklhe341.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpbaqjxytz.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpejpfpfmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wphzdeiffo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpkcizzdrw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpkmnbdddo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpprhidbdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpreviewchampion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wprgirwdzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpsoar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptest.chopperward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptwizeaqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wptywuwawk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpupuiwyap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpxotmywns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqbbmkqtpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqccukjjvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqdnpfaekk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqilhqampg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqkjbnwgit.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqlpepxegj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqmbfqgbll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqmwqgzbjm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqnfiausph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqojusviwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqpq34hlqd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200049382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqrsffhggu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqsdjtoffo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqstgdjlzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqwknmftlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqwowpsyab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqxceukxjg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqxcvqpdwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wqybernkwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrbmypvgjz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wretoih34kh.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrfvwhmimg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrfybiefxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrjjvaanfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrlaxecgcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrljbxceeo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrnkymyuab.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrnzvscihi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrqkevobqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrraehjizj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrxvnmlyfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrxyxzgpix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wrzrkdmqxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsarlpoiim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wskcxhhmue.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wskhlk23lka.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200049407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wslazmcktj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wslyaotmcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsnbkokylm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsnkhqippz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wstbgsoesp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsumittoiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsvfiseuqb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsvnhsbwim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsvtgvygcd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wsxrmcku-115297.proposhareportalauth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtbtkwblro.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtbusfolpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtcgdhwtmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtdiimbvnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wthrdokrmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtielrxrtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtkbopkpsv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtkqobbhke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtlnmgvapx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtlzywwrcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtmipvyhma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtpreenjve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtqabkfkgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtqqoknudx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtredfhfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtxqxibvva.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtxxdlpcxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtyldqesds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wtzkgizwcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wua.soundestlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wucbrxworb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wueuxgqzpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wufhzpphzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wugokyzlgj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuhtucmlky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuimwfhyjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuinso.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200049444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wujxgjcqen.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wulddwacua.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wulximaqjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wunduvhxon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wundxiqezz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuokcjarxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wuqgpcqxdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wurzfvjatf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wusbnelhog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wusslbcder.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wv3vajpaeass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvbmmzipwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvcnbshrfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvdsxzguxp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvhrdbgqzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvhzxwpceq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvldcqytpx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvnfveutqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvpgmbtglz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvpicpcugi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvqvtrpnhp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvrcdwklqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvreabrnuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvteqgpulb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvujvfgrrf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvukgxdnvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvv.lmterbarkbenefit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvv-aol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvw-maglc-eden.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200049473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwmwjiiph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwsorare-com.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwvzonadigitalpichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvywwjcyee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvzkbkdwxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww-magiceden-helllo-connectt.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww-magiceden-web-page2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww.errordetransferencia-via-bcp.pe.hqid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww.transferencia-retenida.bcp.pe.hqid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww1.ibkcredit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww11.lbk-personas.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200049484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwcdwithtesla.xs1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwffioljii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwgbocdxcb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwiznocrlo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwjqmikqux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwjrbgwbyp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwjwkfprmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwline-bitku6.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwnvwulnkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwocrzxtaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwphhwxkgi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwqzmywzop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwsttuusrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvcajaspiura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvpilchinchape.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvv-magic-eden-i.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwvvzonadigitalpinchincha.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200049501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-bitflyer-go-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cita-previa-en-linea-cr.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-codashop-freefire-2025.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cursosdigitalesmx-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cybersport.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200049506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-degelyehuda-org-il.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dkb-de-login.amuchamltd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dofus-touch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europessign-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-mkbnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-pancake-swap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-pancakeswap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200049514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-shibaswap-login.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-www-shibaswxapp-conecct.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseraz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerserez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoersesrz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseswz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aoerseszz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.euapescasd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.smbs-cozw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www10398uf.sakura.ne.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200049524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www12.connect-site.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200049525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2-etc.maisei.taxesv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.acenon.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazaon.co.jp.login.lorgl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazong.co.jploging3hj4yf.syhbq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.amazonm.co.jplogin4g.sdkdj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoecsaz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoecsnz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseraz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerserez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoersesrz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseswz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoersesxz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerseszz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aoerunrez.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aozcset.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.eakl-nuzra.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.esapescund.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.iwander.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.etc-meisai.jp.rxoqpf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.llifeccard.co.jp.sazcac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbs-cozec.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.smbsacnd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-cteetonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctevczesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctevoersd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctevoonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctevrsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctezaonsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctrarsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctruzsand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-ctruzsesd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.srnbs-cuiuocand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.idpass-net.nenkin.go.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200049558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.vpasss.ne.jp.zscgsz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www5.amazaon.co.jp.2ctqkk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www53rdcare-bcdff1.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200049561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www6.amazaon.co.jp.8tp5b5.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwaave.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwhomedecoration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwmdcysew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwofficelogin01.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwpancakeswap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwpfilnmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwseguridaditaubanckonline.gsgdsf425r.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200049569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwsmbc.hnwz6j.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200049570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eokirsesczwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eokisercuind.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eski-cceyyuuyrd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eski-ceusrurdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eski-ceusrurwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eski-ceusrurzd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eski-ceusrwd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-recscrtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-rseucxzd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-ryuscrtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-wcasnust.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-wcasounst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-wcaswest.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-weescrsd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-werscrsl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-weruccst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-werucest.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.etki-werzcrst.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-roeaaesy.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-roeavemw.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.eukl-tuuscsuz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.srnbs-sueaerd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwww.srnbs-suocand.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200049593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwx.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200049594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwxppcqrdr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwzgzhyryy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wx-magic-eden-september-qw8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wx33s1.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxcmmmsdtr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxfxddwfwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxjexpvbiq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxkxirprnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxlisqwitm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxobzlqzvr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxpiexaruv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxsijmmlyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxsnufmrks.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxvexilnvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxwvjqxyhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxzzzgegui.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wxzzzgegui.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyejylrgdv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyfekptssu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyiataxfmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyiognrawp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyjxukadhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyllzoocbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyltcgvcni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wymjvaxhcq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wynvyrtjji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyrtcfcvze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wysmtbhuty.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wyzyesmtzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzbcdljbbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzbhdelmxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzbqeyiagn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzf4cx.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzfoxdfrll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzftpibsqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzhbgkdezb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzifdilxrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzifyzjked.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzkeojirlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzoioixjcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzoubxxqzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzvdrvwtcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzwciplosr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wzyvsxhots.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaaetpqyvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xacsyykcyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xafusabxbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xagfvisppx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xahwoudbdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaima728191.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaimsuuq211.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaitnozrtb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xananft.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200049647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xanderh.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200049648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaoaiqgqqd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaojkflkyn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xapezbfayo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xautqwimbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xawkdtcavp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xaxgkyjdfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xazxqwhlhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbapuyecvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbcfeimoql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbfnf.65918.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgmskkbtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgrfwzajm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbgyxmagbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbmzjqtvcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbsvcdpoko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbtjmyueoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbupvqjdcj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xbwgbmkrdk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xccbhdwpqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcdgbggsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcekdqqsiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcjrhvuazp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xckfwsffsu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xclkkftnke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcllexxtlh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcpesiokbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcpoaxhbzp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcptoiokzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcruqyfjmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcshldvjda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcyfzrnlsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xczavyvpsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xd.dlhc6uk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdamvtbzzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdefi-wallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdevkiyxcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdfccfbhhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdfszhpmot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdgsvpjhju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdkemwkolp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdqtmpykid.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdrsdqpmlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdrwnkajgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdsyasixpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdtkmsvbyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdv.ozvxwyb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdvewrmzzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdvomoycef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdxblgtaum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xdxuqlbcql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xecbufpebk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xechwxjhdm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xecnkdyihj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xedyewxfdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xegdabhznm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeghtcavxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeglgfvstn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xehgblgliw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xehgnpbvaf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xeihzwvxxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xejhpadjpk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xenangnguoivn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xenmkaxsmb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xenodochial-brown.149-102-139-246.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200049712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xep.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200049713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xetqlhypwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xevnvislvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xexynjdeoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xezuepcxco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfamlmeizu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfanlqioog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfeoxxokua9.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xffvutckfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xffzjpucxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfhjofdhps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfinniityinox.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfkrdzkgdn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xflrnosvmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfndbuuqbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfoupcxvhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfouztzetk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfplhrqyfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfshrkarqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfslhqvyst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xftgdxojmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xftzxotvih.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfymgjctmf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfyvmjtryo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfzsolqkiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgbumcbhzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgesvhfaun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgfhdfh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgfilpgkkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xggilmlmgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xghlsp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgjfiamvsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgovmpkimr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xguoaxqcnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgvbigmdgc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgvhwtlmqy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xgzxpckvjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhbxslqqfz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhctruexwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhggzpahmp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhgxfqkdut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhlaivvkot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhliuummwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhlxxtaoln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhmjpngeqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhmxawioyc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhnjv.fzjyzqa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhnzpsszyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhqavorons.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhqizlbuxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhrloywhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhvqsewmeb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhvwkjozcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xhyzaomnkr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiajsadjjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiaofa.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200049768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xibupvwlun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xicvbspclt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xicxwqeuzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xifpbtgnxr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xijsqqslzc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xikdjtifsr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xilqnhchfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiluckqbmw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ximnxltiiz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xinbodbntg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xinsdajbqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiogrmvzry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiqflshtte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiqhawzsli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xisbyjnmvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiscgkcaxz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xisepexntw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiuqlgndcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xiwseqsokd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjdj1x.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjfdgdfhgdhu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200049789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjfurwxwcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjgchwqwhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjmhmqgiin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjpepzhhnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjppemtusx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjqulxfhvt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjwweuspaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjxwfsksvv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkanzknwgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkcswwxkma.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkdudiognk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkgrftljou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkkwlbuibt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xklzfkwbnp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xknaulmgym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkolqhrnsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkqqhatugs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkrdytxief.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xksktwytgh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkvujjasry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkwjppduim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xkyadrymad.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlhcwtwbrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xllzqvnsij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlowkzajhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlqexxohjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlqpxcrcnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlsv.oalt.cfgliders.com."; content:"Host"; http_header; classtype:attempted-recon; sid:200049817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xltowuswhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlvosjykqj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlyncpiumg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlynutdeus.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlypmrjxby.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xlzwygrvgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmbuuiigye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmdzrhwwht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmhdmqshyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmhowhrolq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmiqxonemp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmiwlpzxal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmjazrtxtf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmngsvxsmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmnqtlrvdc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmqieeyqup.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmrhtroukg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmsdlgqbfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmsite-coin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmtntydhtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmxrrxaaqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmxrtrftem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmyzchdryp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xmzgizvals.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn-----6kccgdjl0abvczjkklk0ahex4f2kj.xn--p1ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200049842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--allgrolokalnie-x4b.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200049843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--conta-atualiza-o-snb5e.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--dao-ooksrare-78b.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--hastaykama-2ub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--home-magicedn-cess-vsb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--log-in-magieden-omb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--looksrre-5za.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--ltappen-80a.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200049850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--metplex-jwa.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200049851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--panakswap-s3a0c.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200049852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--prua5764b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--w1ai.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200049854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn34r.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200049855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xncnunmhdt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xncquvescq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xncseeijwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnhmoxmqhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnieumbtry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xniumactog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnnudcrdlk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnowehfuoy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnpfyxznzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnpqqxmfzb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnpsjdakni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnuvrlvvrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnxksuteox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnxxn7w8asd.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xnzlovdexl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xofmopxrcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xohufznkes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xohyxlnafk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoihufobzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoiqynrfnd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xolkrqmnla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xombyoruaq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xomyohiswl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xonuluzpye.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xorfaavoqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoslzvmkjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xovloktepr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xowomjrtcg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xozddajkfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xoztzaqbda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpbztyzaki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpdozjcuef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpgathtopt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpgiaakkhe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xphmtqlihc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpmxqsbrvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpqzbqbfee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xprfinnwsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xprswebsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200049894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xprwwonnuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpubkoyjjy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xq5807.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqcpeou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqevrvsssg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqhridasvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqisdmsuxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqmxlgkycc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqojvfkzvf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqqkfpstdh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqrsgecpbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqsjthvbgl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqstsmiajv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xquhmerroi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqykvingqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqyxffmcin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqzjewjfpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqzkbzbxlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrfmylkvbc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrguzxilvw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrhdysyjvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xriaqdgecm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrjkdkdted.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrlkqddggj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrmdmuxnnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrnfykbimk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xroqjhevgr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrozzdeynt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrpinvest.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200049923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrseixwrlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrsjyctosj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrvhlbhjqw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xrxjsmcece.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xryqskfzmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsbdearikj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsbrookshhjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsfnkiblzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsixghxkki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsjfgdjmqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xskadmhofz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xskrzvqpkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xslwiyjzsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xslwrnjmcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsmrzstasz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsportak1xsxrs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200049939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsvjvwqpmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsvnfrfpka.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsvzfwzjif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsxmslsxnm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsyuetifud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsznxsjfzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtbkfeykyf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtckqewqgv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtevjskjmq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtextmudfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtfpgbznna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtgelnybom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtgxahpctc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtkgiqzwmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtkszfyqwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtmozxuddf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtoguwohku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtohzbiexk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtpjlvgarq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtuwzrlpzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xtvvanewnq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuatqwuhoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xubmibloah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuevvthzbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xufqtzflfk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuhdcouqxc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuiuxetxqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuivrlozht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xujkqnhsim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xujxjoqksv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xupsjadetf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xusbmamvjn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuuybznepp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuvmealpsf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuvngvrqes.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuxwdbnevc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuydiyahun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuygzgaphi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuyoissozo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xuzzysaoff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xv.hmemwyd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvaftqyyfc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvakxlqflo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvalhalla.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200049983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvbmndazca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvd.mf7t0ah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200049985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvdshder.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200049986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvedglkbgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvejbczgox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xviogtmpgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvkhzdolzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvmjighcda.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvmtqncdzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpagtjjbj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpcmiqhqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpothipzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvpybdgtnr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvqxfjmvez.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvsmehydxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200049998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvtfhn.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200049999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvvelpkcwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvwijtcpzm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvwqhfogrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvxkdfuwte.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvynduwkjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvz.09vnsr7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvzehxzixt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwadafuzae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwblytmxur.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwewtjexhf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwfnlwzham.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwiaxcrhvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwiyrnvcrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwjtguubta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwqaxadysr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwrppjevwf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwruvedzxh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwubiacdoc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwwvypfuix.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwybruoods.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwyhizzrah.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwzfbiftij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwzndkpuos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xwzrzpwunl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxcvlsvpmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxela0.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxfnjedvrh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxgyxoeynf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxhmlesefy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxkl.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxntupvgev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxofzdwwmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxphase.office0.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxpnbwespr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxpsmbogjr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxqqasw.s3.us-west-004.backblazeb2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxrvravokj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxtbngaybj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxvjgwgtkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxwuiqwjkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxxpolietrayxyz.homes"; content:"Host"; http_header; classtype:attempted-recon; sid:200050041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyawtsliyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xybybopsum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xycfhqnvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyggfepwal.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xylwgrdmek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xymkisnhth.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xymvsnygoo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyomkmyinm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyoxxcyttg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xypbryoulg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xypjbbgkmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xypttrbjpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyrrcwqkpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xytarwdbwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xythndo.punctulcentral.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyvjngthfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyvxlceibn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyxfbazhxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xyyzvliqgk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzbpngxcta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzdcdsxrbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzdlizyvzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzfzgsrezr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzknoskyfp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzohutlmss.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzokefikgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzoquhfndw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzshkzkhfv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzutdthpiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzzdktajyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xzzvdxlbwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"y55432.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"y8kem.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200050074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaahiu.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200050075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yabevjehuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yadeargbht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yadgiabuou.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yafgorees.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200050079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaflyqebbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yah00-103777.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-100350.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-100414.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-101641.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-102926.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-104414-104154.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-104801.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-105946.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-107539-101448.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-107683.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-108394.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-108472.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-108567-100912.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-108783.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-109226.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-109332.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-alert.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-att-emailupdate.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-att-updater.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-inc-199.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.m3dg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200050101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.sx88.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-mail-101460.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-mail-105767.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-mail-106463.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-mail-updating.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-team-101880.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo.k1izzn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo.mailservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo442.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahooatt-102261.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoomail.server10.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoomailsupdatesyah.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoosyncc.boxmode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200050114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahpujzzwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahuomall.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200050116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yairix.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200050117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yajnjqksmx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yakgdabevi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yakquubvpm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yalpwnfzsk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yandus.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200050122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaoklkomat.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaolwlnxag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yapacldyho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqancnixu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqoobi.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqqeghbun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yarchebqbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yare-jumps.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yarltjpeyi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yarmcocjlx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaspxhupel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yasufhgiuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yauixurgox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yauqshmxcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yayanti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yayfepkrzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yazioogubw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybbmioivik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybezkocfxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybfdvjmtj-01924995.freshminlog.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybfdvjmtj-01924995.middocmain.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybhmuybiil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybiaojhcqs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybimlknenc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybkndmejpz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yblcfouegf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yblmemvrfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yblvxvxslf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybmonrozxj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybmytgpljx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybogctfdws.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybqjbkrmvu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybriojoacn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybwkwjwcpd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybwsrtkgqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybyxbmfsjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ybznfvhjjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycabukzlfb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycbnmbtcuop104001.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycccwibgiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycdbsiupbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycdcusewhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycfgvsgwjd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycfqtardfy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ychbizrujb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yckinbfdkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yclivrzpir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yclrluoipx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycmoautosj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycmplcnpfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycobayiwps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycqvmzvoxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yctdpcloym.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yctvgxljfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycyhbsrulx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydbkftupjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydgrqhhenq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydgxtwvkao.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydibohbaoz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydktplowim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydnrooedst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydoevvvihk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydpjykjobj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydtpiejbns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydurigmavs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydwfznsbxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ydzrelslon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yebdtcfwkg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yecgjaqslm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yedoufywmg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yegknmxdlq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yejlpxpxnn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeocbwpdxw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeogmmlsqc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yepowowcvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeptpvnetc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yesqyudysc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yethaiameo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeuqyryevb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yexxvdsyay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yeyyyqbteg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yezmbsdqcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfazxfderm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfbadjxkik.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfevvkegep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yffsithhwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfjtwosvuu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfnjlphkuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yftfmznujr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfvaojycyv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfwniwtbho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfyktqfyrb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfyuflqqpb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfywqggtin.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfztswyhkp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygacxnmsxs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygajvduwum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygaxrmulre.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygbhn.upling.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygbmtdwfar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygbrvydcbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yghb.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygjiomhyux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygorseasqq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygotw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygoxhmzxbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygpbeteirh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygqbvyowey.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygqxpnfbjt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygubewtocg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygumcjpwla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygvlyodeho.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygwaaefqag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygwlmnlbxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygydwvyfzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhbcjlffll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhcjzqluij.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhfdb.wta4ji.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhfnybqbow.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhgiyeeumh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhjhn.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhoieomxkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhshcnqxlt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhuvsksfwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhvoammtpg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhxczrjujz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yibgtvzbbt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yibjxwprwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yicjmdzjxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yihafyshpv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiibmsrehp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yikezknmaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yimlqjverc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiokbzacoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yip.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200050257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yipdgyrnmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yipee.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200050259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiquguxloz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiwjxzfcjj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yiyimjdchm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yizmpagupm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjcevemzll.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjcpcxtyav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjcwofyvpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjgmiswfcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjgvcrfngv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjiknpjjek.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjjyowawju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjjyzokefm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjlxrbmbae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjmcmsunhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjmhixscrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjmwowbjzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjohawgsvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjppdlqtqh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjrxddzney.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yjtiftfceb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykaprtvklc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykasldjvri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykbvlszcbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykbvnl53.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykbxruvsoh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykdeckhxdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykekyozlfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykfbhhtveg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykfddvgvqo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykgcvivgbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjckxiclb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjiyecyfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykjptmrrmn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykljqufais.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykmitfyacs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yknvettqlw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yknvoszlop.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykpjzseluz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykpmmwltqf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykpqlnddpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykqwjptarj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yktlnxptlg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykwfiguizo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykxhkbhjvn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ykzruvtjzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylaacccrgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylgsubofkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylhmnvndwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylighecldn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yljbbegrug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yljzhatgbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylmldwyubu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylmzyypcob.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylnsovrqcx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylpwewyvaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylrxdgtoju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylshatzwql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylusntjrnw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylyidpcyrv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ylyomwxczz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yma1ll0g0n.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymaclzcgxx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymcmwbiafj.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymcmwbiafj.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymcxurzqnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymefzyrkgw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymfbdlhohf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymjhpsgwov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymjrohietp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymlvmoivrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymoydopxbd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ymvbwhasvj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynasnonepi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynauvpslzn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynbtpjubux.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yndmfocikf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yndwpujhhw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynfdlxsfpr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yngxirpjud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yngycinrse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynhwblmhcz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynhyzatzgg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yniykzassaz.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200050342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynjcxiehie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynmvcofzly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynqhkqcglc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynthgbbaui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynvukostzg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynyhyqaxsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynyvjzciae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynzdyvsqep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoccmvhdjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yodsecinserv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yoefiseoos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yofepysbpl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yofeszxhgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yofniaeixl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogapetz.mint-nft.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200050357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogdarshan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogicpa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogini-polygonbc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yohbktwemz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yohiboijos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yolunu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yomesmxxuj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yomtruxpwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yontxaprdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yorngzcijk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yotestlab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yotuhqsxiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"you.weebitbig.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youn.bxxnskkdkdkrkrnfnf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yousee-refusion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youtube-b24.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youugvotlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yovicpahdg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yowi.furcous.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yowicrpzsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypmcsgtlir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypoedyqrpf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypohyextap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypokfnpdtx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yppdxqiknj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypqijvybub.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypqsvyfmwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yptctvkake.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypugmopnqz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypuwrmdrok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypvhpbcwmv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypxwwdleyq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypyeouazee.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypzecmuqdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ypzflhxvlv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqaznnwzet.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqdnrjhjfr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqfwzxcgzo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqhwdrfoum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqkykbcpjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqotmwkvbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqponqxknu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqprjxfvzk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqxoonvvhb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yqxpbuthqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yraicpeqke.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrawxvnwnx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrcoder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrcrnqjnps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrdbmaoqrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yreqghgpjq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrqetweldi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrqxhabwgm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrsfrmukjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrsggs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrutdatuge.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrvyajslsy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrxupxzutz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yryipjsixb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrylfeozxb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yrzfsomwrx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysaftzsdmi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysbmojbrwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysc.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200050421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysczdajs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysfaqdxkip.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysgjjnzuna.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yshdzismyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysmijwcdul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysmknsevuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysmudyzpbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yspiojscjh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysrdgifrai.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysschakyhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysui.mantair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysvhnvguqi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yswyjdlzuz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytadjzkqbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytatyrxvqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytdefdpocn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytek.co.il"; content:"Host"; http_header; classtype:attempted-recon; sid:200050438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yteztqsgwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytgpcghmbo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ythmehgfdu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ythubkfxsj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytitizgvgt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytjsczpsog.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytjyhegf.byethost32.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytklhg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytmebaecnj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytmvqbdkxv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytnfifrxqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytnolhbsmy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytnrtacrkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytobrjeeir.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytokokyyhj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytoxuthzli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytpwacukjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytqaxiijoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytskyxqkti.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yttrzfhfwz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytvaneqstx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytymawnwwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yudatingguide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuews-hruoncy-hreurds.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yufazvstgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yufptlqnmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuhjn.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuhotfnrvg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuihujuxzy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiooklo6778.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiqwdendsi2312.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuivvbfcrn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yujexaeejh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yulidxywqr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yunpqfufzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuplteyoyl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yupxrrxlfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuqmstjqri.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yutourange.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200050477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yutrujdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuuscodghs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuwhoklmvp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuwuovefdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuwxsjjrkl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuxgqngjmk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuzrbqlpex.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvcybyazvq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvebxqmehp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yveemlfpds.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvfzugjiqe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvgltxmxwp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvhqgpliul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvhxznnkkd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvkagkuaut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvlgzpptfs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvodcrbbdo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvqhkfcfxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvtlrmjmkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvuboaklbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvutfbjnwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yvxuauwovt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywaqwedding.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywasbfivfw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywbytozptr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yweerawabn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywejiwsett.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywewjmauyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywhpriinrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywigjpsqcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywjswvzspi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywmwmvgkbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywnsijleyr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywqimwpukq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywshlysilw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywsscwtckv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywurtjmpmc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywvgfphfwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywvhufcida.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywvyvhcpbl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywxo.mjt.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywywsqwrgb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxaoatjmfx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxaqzubroa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxdeoixroy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxdhjfijhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxegezaqly.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxfxupspvz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxsanconfirmfb.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200050526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxsrurpiei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxssopfzox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxsvkjvepk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxsxoxanwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxuartwtil.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxuszxviyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxvxfezpnc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxxdddscra.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxxxtlkcmt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxyooqayiy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxyqqhpwmz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxzprldawk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yxzqhvplxn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yybvpbftky.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yydryxnlrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yydwrbxnbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyhbbwsnmo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyjnpdywzv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yymyhzgsuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yymypfjlbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yynpdlohns.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyupzlykle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyvhdeilyw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyvyn-6aaaa-aaaad-qd74q-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yywvpoacoa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yyzbbeszyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzcdwyvpqg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzednvbpfe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzhrbbwnon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzjnfrzapk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzlgmkdhko.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzmlcfgkgx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzrmovqluq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzwubtmqzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzxqkvpbcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzyfzrfjia.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzzbupibuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzzhmtazkv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzzmgmdixl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yzzndbtwtn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z0nesegure-viabcpcontigobeta.englishtutorweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z2tkui.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaakowl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zabaonjrbq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaccsstgoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zagxeevwrg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zahal.naturalbeauty.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200050573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zamowienie.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200050574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zangeneh.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200050575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zapbljyuem.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zapplaunchpadlive.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200050577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaqabcoint.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zaqfmuasvd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zautt-paipt-ruont.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zavlwmhwwy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbaiualogn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbavpuydpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbcrybcqhs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbcvfdg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbdeltnxsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbdhetghtl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbhpgpugwq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbjbpwztcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbntlybneu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zboteomgod.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbowxaye.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200050592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbpbpiagml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbrworgbei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbseovdpyb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbvtxqhqin.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbymucakxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbyzvcugxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbzcsulihr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zbzfeemgrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcdexvthse.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zceofcfwts.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcfianbiwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcgxtzggrp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zchkesnyvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zchzipsqfl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcifaowddz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zciroternind2718.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcmnmdvqpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcoolbcnaz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcqaavdmxi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcsswduybg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zctorwmust.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcvpnscpsm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcwvbicdgy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcxrhfjxbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcyndededf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcyordduxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdassaobjc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdbzglfbdp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdcrwbyzvb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdg.867nhmd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdhnwqkjbi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdijyxwefb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdiumnxuau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdnovnepkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdtzbkqczn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdurgnymku.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdwljvchuh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdwtxsvjck.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdxcviwxok.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdxfqwe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zdyrwpffbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeajwelksu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zealous-cliff-0a8252010.1.azurestaticapps.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200050635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zealous-satoshi.109-71-253-24.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200050636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeboq.vailice.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zecca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeebdxcpsc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeevowsbdq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zefibhwueo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zehdinbdzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeii-egipt.bombsquadz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeiron.net.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200050644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zekuciqwqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zelfoplossingsgericht-kvk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zenacademy-freemint.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zenacademy.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200050648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeokcjmrar.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zepmqfnsmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeqhikbhhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeqryncwso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerdgkvyhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerhubsfiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerione.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200050655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerrion.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200050656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerxfflbph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zetbkumvlm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeudshfxst.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zevalogistic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zewkwmmytd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeyeymbzrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zezwuqnpzw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zezyoucbji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfbmoczfsb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfcfxzqlrq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfdlzmwiza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfepguvpft.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfhocbsrkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfhzkvjnca.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfpzljuwpu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zftdggljnf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfwfpypxrz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfwhgtxvry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfxzgjsndy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfyljohyuq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zfzwpjukam.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgdltkhlyo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgedmrpcxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggepsgwpq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggtfwcguo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zggwwswqpo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgkjbijpcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zglyxdmjhl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgmgxutrwo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgmtyiwbpy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgoqrxncln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgotwurepf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgwvslowyt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zgxtwmiqzu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zheard.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200050691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhkhfhaamk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhnezkgiav.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhngovwvlj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhnygrahfi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhnytifipf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhqrvibait.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhrqwjknjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhsvhbmxdx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhvkwnvgji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhvxbzuneh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zhxkcblafq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi992883923923.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zifpsxkiay.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zifqporqvy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zigmqmjokp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zijhwxsgpn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zijyvrfedg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zikwazxazb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zilrnwjoii.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbra01964.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziqverenze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziqyennsha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziryyhnnhz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zishiziocu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zisywubbuy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ziyfokjoqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjbtgcqpwt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjcidqroln.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjcjcuyroj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjdhfobnqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjeoyovfdw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjeuhtwdnh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjeywpnseq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjfvdaitic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjhycdcxjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjizefzjve.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjlyofudbe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjnlcfddjx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjqkcnclwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjuczrltef.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjulkicage.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zjyflywsqu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkawlsknfo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkbvzdhkco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkenttzyfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkfulludzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkfwelucel.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkghwrralh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkkkxvwsrd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zklcplynuc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkpysimvvo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkqawuuczv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkrsgisknx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkugmsraev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zkydiwvala.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlajuqrixk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlcwubgsht.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zledgmkcib.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlhcxenueb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zliblfclya.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zllsnspjxf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zllupekgga.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlozxxtlno.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlrcyleklt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zltjsybtcs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zltqmwkadb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zltvtkqwul.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlublwgsrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlxhqggsxk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zlxpucbtkz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmapcmnddi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmcmjoeyzl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmepatxyxq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmeqstds3oun.usemoralis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmfjscihos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmfqnbxhfq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmivxhkjtc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmkrriaksi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmlacupcol.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmlcngnefy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmmspdisoj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmnkbqhply.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmoeserfer.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmrdvqafso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmuzezbqsn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmwdilunqn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmwivajhut.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmwunspvfj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmwxmrzlap.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zmywtscqlc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znabhovuau.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znazmmhbff.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znefjgcxhh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zngigrjlif.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znotquzewp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znwqnarcji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znzbxamddf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znzllwucwi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoawbukdsa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoblrjsdgo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zocjulzfnu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zocycqgitj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoegcieaso.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zogojxcuon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zogvieqjbu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoilhlfvza.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoisdqcdcf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoixtwnzcv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zojmaqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zokwxbrhtd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zom.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200050803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zona-segura-interbank-personas.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zona-segura-interbank-prestamo.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zona-segura-interbank-prestamo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonaclientesegvra-mjbanco.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonapichinchapp.homedigitalpe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasegunraspichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonaseguraspinchicha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonaseguraspinchicha.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200050811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasegvraspichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasengurawebpichincha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonddkuwei.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonosegvra-mibnco-pe.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200050815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zooxbwxrej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zosggmsnwj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zotfmnvukp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zouqopovui.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zowvlgpnxt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoxjwzhdkq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoyodetxze.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpajsspkkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpbtnaiyqa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpenmsqqgn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpfvsfigzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpmmxdhftl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpnybcfwim.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppcehqvml.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppdnziead.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zppsazbamb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpqytoaekz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpwroyozew.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpyaegwazp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zpzeetrbis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqahckrfwe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqbnsplhtv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqcrzznmjs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqhzbkohbf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqmvjsvayd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqqpgukrry.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtbsfykkn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtdbkijdl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtifnrizz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtlssqdsw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqtvcbzovp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqzjowmezx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zqzsewgzqk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrasfoanbp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrctfczern.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrdaccrtpj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrdkxfkqdi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrdmegbrcu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrgiqzowfg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrijibqmwg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrjphhwkbk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrlbsoyetq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrlismktvc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrnlfpxocb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrpbahoazx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrvoyaysjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrwsx.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200050862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrxofzurvx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrxpxhieps.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrzxklvtuo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zseqcxsfrj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsfdguqkgd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgekstxld.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgsayoqwb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgtdpautm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsgxh.supibao.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200050871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsiexrtbta.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsjywnbsng.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsmmpwwyle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsngmaelgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsoqsjcyyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsqjdhfiic.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsqoxsswcw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsrsrctaiv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsslfwukbh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zsybiwsyrk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zszmsnlkzi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zszprakbhi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztbzifaylh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztdqmouxla.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztdqrqyqgq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztfopxteyz.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztfopxteyz.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200050888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zthasibyzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztiafubuzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztjxbrkeag.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztnlrvsmny.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztowf4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200050893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztpgfncnxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztqchtejph.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zttnomwmej.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztuujsxcja.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztvxukxoov.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ztxzdctxzz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuadqqhqxl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuaqnkasug.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zucmpnjves.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zudawutwmm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zugajvsnwv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuiniptaos.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuitnntgum.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuixrsrguy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zum-gutmann.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zumi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zumjdciqli.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zumqkwcdle.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zunemolngi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuod.com.sa"; content:"Host"; http_header; classtype:attempted-recon; sid:200050913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zupfyysjmr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuqckebblv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zurbrioerf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuriescents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuvasqgyqp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuvqmihpbv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuvrkldwcy.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuxrnuyfrs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuzcgziijm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvdltlyfxd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvdmuoqdmd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvento.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvevqbzopl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvkvkjfvep.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvlfuipjhd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvlhlrkpdb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvlztmmmlf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvmlyifafn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvmqltowjl.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvrvurlkkc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvsaxhldwm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvsirnmpjv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvuqmgkzuw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvwqxnqlud.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zvzgukocwh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwdixrlqzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwdpbnufuv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwdxfaflyz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwhkxdantd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwiulcuyji.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwjhxqqqni.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwkrsawfhm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwktfdepae.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwlojlmada.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwmiwlxgfm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwohluyiiw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwphqeumbs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwqxsualxo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwrvytguwa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwsfnemtev.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwsfritsvk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwxbqrscbn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zwzienucxm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zx-kyber-swap-swap-acessoo-y0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxdfnskbzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxeqmcproi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxexafyaqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxmtjpbror.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxpyadvmtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxrppkxovn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxtowznvql.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxttleielz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxtxdwyiju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxuhdhbdwk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxunfsgniv.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxvathfdj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200050969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxybgrztuk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxzdsjnewi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zybdyisism.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zycvnarlkk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyfqddjttj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zylzpgzste.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyncmhspyx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyqfcjreyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyqultskzd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyrpsnexzx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyswgqvndg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zytd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200050981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyuailgsrc.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyvtcyfvzj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyxscliqki.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyyewnlhzq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zyzrwecngs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzdcknjacx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzdmsjekjf.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzekbb.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzfxvhxftw.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzghpsnxoi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzhtgceees.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzhzibigvh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzjiovfral.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzjuokubun.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzkbks.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200050996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzkxobobzs.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzmnubukys.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzmtcntotn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200050999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzpqccivio.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzpvvrjftb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzrslywryq.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzuabgyyhk.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzuwxnhfxg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzvcycjkha.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzvwnrjsju.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzxegowtyj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzxlobgzaa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zzxyear.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/signin/"; http_uri; nocase; content:"0c63c45.netsolhost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bros/"; http_uri; nocase; content:"0nebet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/s!bcxisnewh_cnvrnkj_y2f1eccpwq?e=gvtbd8pbpealap_ppbzgja&amp\;at=9"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200051012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/u/s!asazsxxj27tygrqveud6b2tyextk"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200051013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/u/s!avqb_9face4sz3yjsonzujzcdvq8?e=hdbta4"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200051014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w/s!aqb1sjv7nuauan8etr6o4rb2z-8?e=siebms"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200051015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#eberhardt@gmx.com"; http_uri; nocase; content:"200fovnkhut5iu3l64oirtcuumcfn6rf0lm9cbpehfe46v7j1s9shlg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go/?www.orange.orangao.c%cd%8fo%cd%8fm%cd%8f"; http_uri; nocase; content:"20khvylyn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbva/592cf4/425bdbd3-91cf-4e9f-9498-7a06b3ad75ec/?test=1"; http_uri; nocase; content:"28ecne20f9u.securetnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11wyd"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6pcza"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ijuwm"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kmvno"; http_uri; nocase; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/3rdst/8-login-form/"; http_uri; nocase; content:"3rdstreetmarket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/jarida/includes/widgets/stuff/login.htm"; http_uri; nocase; content:"3rooodnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d5b4121d-ad8975c1-fc53-41b2-bad9-ecb97743ffd4-000000/p1odbvtfelzzx9amvwo_h954np8=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d5fb3b48-737ccb85-d5e2-4457-a851-976cc0f4bb46-000000/7s-v3-kzdc4bgzegonycqrjgcoi=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d603af46-160c71a9-c106-4e8a-8d41-5f8c8fea17a9-000000/c9_d4zic3z0jjatwzj75zswof1w=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgw2x_btv/1/01010181d641f3ae-89c7fa59-82a2-4f6b-b2a4-cdc8626f95fa-000000/hyy7ncrmtxieavrn3px4goieeos=278"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https:%2f%2flnkd.in%2fgzeded-9/1/01010181cf1b9616-bcd3d213-f58a-41c0-a6d5-6684bb69f8c4-000000/zraw1xg7um5rfbxqlmasuiteqri=277"; http_uri; nocase; content:"7b631qxp.r.us-west-2.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mvoer-g30e59hg-wrnv-wkdc-9wehrj5-0gvnw-v9cnrv.html"; http_uri; nocase; content:"80j-0vfckw-efrjg-wrmvewnrbv-0wmnvb-0r9nj-09rv.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/css/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/img-temp/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/js/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/openpc/directlogin.do"; http_uri; nocase; content:"a-q-f.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb3gemh_1ogg?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb7k8ik_11di?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/p/s_doco/epll1o29zrvlm4vmb_mz880beenb3b0mhlu2k0cfnbvunq?e=upgqwq"; http_uri; nocase; content:"abeleclairage-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/u/roland-richard-19"; http_uri; nocase; content:"account.venmo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accounts/login"; http_uri; nocase; content:"accounts.senapchat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accounts/login/"; http_uri; nocase; content:"accounts.senapchat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hipercard/?userid=&amp\;uri=8qitdq&#43\;xfqvlrupbz0/u38ci0dgknqgrp8j63d/bt1e"; http_uri; nocase; content:"acess4r-luizaftura-xvt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hipercard/?userid=&uri=rwjn+z4bhropbzmmsy2tyansx2qecsmxf2sdtmkbc/m="; http_uri; nocase; content:"acess4r-luizaftura-xvt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?gclid=eaiaiqobchmi5snb6ole-givnhatbh2frwujeamyasaaegjzppd_bwe"; http_uri; nocase; content:"acessoempresarial-emilio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/bellcocreditunion/"; http_uri; nocase; content:"admin.fifoundry.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/public/backend/images/team/salamonca/"; http_uri; nocase; content:"adultadlist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"aeafyh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"aesoioesn.aseoseiseaccn.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"aesoosesn.aseoseesceacn.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/ent.com.html"; http_uri; nocase; content:"aestheticclinicgroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ff"; http_uri; nocase; content:"aig-int.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2005/03/colourful-life-of-aij.html"; http_uri; nocase; content:"aijcs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/svxc/index1.php"; http_uri; nocase; content:"aiousolvedassignment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"airhandring.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yonetici/newdocs/gdoccc/"; http_uri; nocase; content:"aksehirevdenevenakliyat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ats.html"; http_uri; nocase; content:"allfurnist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pc/amazonall_signin1.php"; http_uri; nocase; content:"amozon.co.jp.llhgmt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jps/webmail_reset.htm"; http_uri; nocase; content:"anekaslot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/message/c3upfo4mvzsgg1?autoload=1&amp\;app_absent=0"; http_uri; nocase; content:"api.whatsapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/064ca177fcb7d3b79b1a0de5fb00ade981aeff90?"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/26bcb52213a6d759d76014ff4e11c37cae6ae56c"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abg7_xbalh"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kektfripag"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mkj/fixed0/index.php?user=user@domain.tld"; http_uri; nocase; content:"atpproduct.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shop/v1/?vn=ctv-tfnlinkbot-pc4-cos-usr-bdl2-alt-wrl-wrle-cc1-cic-cf4-dpf&chatmessage=false&slidechat=false"; http_uri; nocase; content:"att-promotions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacaeoseaseacsrceroi.visacucarnsvserroreiraio.xogutju.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200051075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"avscacieosecseacsrcevoi.viiacuvarnsvscrroserraio.k8jaf9u.tokyo"; content:"Host"; http_header; classtype:attempted-recon; sid:200051076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"azeioaz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/003.html"; http_uri; nocase; content:"bafybeiaseiccnilblsdusmrkofxzzedulqsti52qjejstblyi7oj2ritqq.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/midi2.shtml"; http_uri; nocase; content:"bafybeiatazrnklh7otmqeskp6p6etm4jabyeqw5equo3qvirvueabke7ka.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/settings.html"; http_uri; nocase; content:"bafybeibuwq6f72ygvx5ugbxxdbwlsq7gfkusidamchgmw3jbaihaxxrpzm.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/004.html"; http_uri; nocase; content:"bafybeibwcpp2vkw3vf6x3lfktwr6ujy25ptg7wc7sgyyho2bfhzatwxd5e.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/access.html"; http_uri; nocase; content:"bafybeic257mkvngc3pv5veu3p53755m6czhciltasta2rus2ihldq2gm5q.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mn3.shtml"; http_uri; nocase; content:"bafybeic6tdf2uq64t6b54iyccnmsbvsthdthu6x5at3jweiwb4phbjqgii.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gerra_v_ap2.html#xx@xxxxx.com"; http_uri; nocase; content:"bafybeicdymfietqoikbxd4plv7alxlclbiuka3gagyrfyodoyqpevevwbu.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11.html?fondos@bancopatagonia.com.ar+"; http_uri; nocase; content:"bafybeicleia5sx5elbtmg5nmrv3lwkupbji2wswwgv6i7wsenle2aphziy.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/settings.html?email="; http_uri; nocase; content:"bafybeicvhkqz7kmsilrq2zrqilf44d3cqqk257fudrd2qkfbp4hewy5cge.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alphash_cham-e00.html"; http_uri; nocase; content:"bafybeida3c3nekpk2nctanrr5qh3ywgcdudmmh74vq2sckzbvi3yysyve4.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wc1.html"; http_uri; nocase; content:"bafybeidjf7kie7rbl47dvjch5y4xabcdf4syvobobaxzc7cv255wev4hia.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/offtyj.eur_cham-e.html#info@tritontechnical.com"; http_uri; nocase; content:"bafybeie347ua4igosgobn765co7s3foo25bev3vwnemmie2wyuzalvcezm.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/offtyj.eur_cham-e.html#x@x.com"; http_uri; nocase; content:"bafybeie347ua4igosgobn765co7s3foo25bev3vwnemmie2wyuzalvcezm.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/asb.html"; http_uri; nocase; content:"bafybeif5da5uioyg7zqeiciidlid2yp5pkrwmolqm3mtw2qlhwfsr4feu4.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p1002.html"; http_uri; nocase; content:"bafybeifjbhlpbmclzq54z7slpt77fzx7hza26uicqrhmr22huqzc4jdpqm.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/30093a.shtml"; http_uri; nocase; content:"bafybeigw5jlwvykqqwfwiz7bykja2imjyes2ouyl57dd33vpydeip4efgy.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/acon.html"; http_uri; nocase; content:"bafybeihsnmtiptw2tirq3rfba4mgdqbrzvrcynn74bgte647u2ithenycy.ipfs.w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200051094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/net/login.php"; http_uri; nocase; content:"bagmakingmachine.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200051095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/index.html"; http_uri; nocase; content:"baovesusonglcxt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/js/api-gantengz.php?key"; http_uri; nocase; content:"bardestani-carpet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/css/apicuy.php?key"; http_uri; nocase; content:"bardestani-carpet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/login/"; http_uri; nocase; content:"bdms.co.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200051099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/chpost/ch/?pwd=post"; http_uri; nocase; content:"bestdoctors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/chpost/ch/clients/details.php?verification#_"; http_uri; nocase; content:"bestdoctors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/ngg/wb/index.php"; http_uri; nocase; content:"bikeboat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?bfp"; http_uri; nocase; content:"binancezh.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200051103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/mtestan2_binghamton_edu/edp3org-ymjbpyq-3xfgf5ob4x8g4fhb0siyy3cfhyg08w?e=4%3an9hzlk&amp\;at=9"; http_uri; nocase; content:"binghamton-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h67yt2"; http_uri; nocase; content:"bio.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200051105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pdf/pdf.html"; http_uri; nocase; content:"biofarmint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assistenzabper"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbancaaggiornamento"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuvgz"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvdca"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fveke"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvfqp"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvgrk"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvieb"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvij8&"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/numitisi"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/osrsgiveaway"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezza-hype-it"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200051118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ijwsm2"; http_uri; nocase; content:"bit.ly."; content:"Host"; http_header; classtype:attempted-recon; sid:200051119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2zejaht"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34hdmyt"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/366qkes"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3btlfer"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ccqacg"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3cfu5zc"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3dj0r1p"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3e8kw2o"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3jkf6va"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3kueruz"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3kworri"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3lamwcc"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ldovbh"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3pvc7vy"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3qplrme"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3wdi2jy"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assistenzaidentificazione"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/banbif-pe"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcp_wanuchay"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/livechat_irs"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lmterbank"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shpee_coins"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tranfer-retenida"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tranferetenida"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/transf-retenida"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/udmcmadcracked"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifikasipemblokiran_id"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3g1epw3"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3jrtmmu"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a/blocked?hash=3wk62fc&amp\;url=https%3a%2f%2fsafetrac.co.ke%2fcgi%2fhome"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?redirect=ufbr"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?redirect=utqb"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?redirect=v9dn"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ufbr"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/utqb"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v4j5"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v9dn"; http_uri; nocase; content:"bitly.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200051156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/balances"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200051157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/trade/now-e68_bnb"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200051158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/szl3ok"; http_uri; nocase; content:"bom.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200051159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?aplicar"; http_uri; nocase; content:"bonomequedoencasa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verify/m&t/login.php"; http_uri; nocase; content:"brauhausschmitzoctoberfest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/richardmcc_winebinends_org_uk/eqv_1b7hjo5gngtopu852xcbwjtdbkujue4wq9ljz-xq5q?e=pjtgzh"; http_uri; nocase; content:"bt843843p1-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go.php?ssl=yes"; http_uri; nocase; content:"business-wireless-att.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/dkapaon_brandeis_edu/es1enxze9_xblrutnfjfpm8bbxkssfvrpe6cnirweqaapg?e=4%3afdar13&amp\;at=9"; http_uri; nocase; content:"c569257608da4dcaafbc-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.php"; http_uri; nocase; content:"cancel-denied-payment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/payment.php"; http_uri; nocase; content:"carepath-recruitment.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200051166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/9245db2516febd1d3c13c0a90f65c615"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/fa15a875fac963541c5da50d05c179ac"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"ch-299199919900.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask/"; http_uri; nocase; content:"chainnlist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post_12.html"; http_uri; nocase; content:"chronopostvalidation.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/rdh-rjsrv9zzrx57iscgov74o1gka4qjdfj01qr7v8-pkjgyvn50tivt7pzqgm5kuqdmonqle3f8eq_t8f4xl6jdozabmf2lxy-888ai8hdji633rg"; http_uri; nocase; content:"ci3.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/djc3ckf7jcnj8l0duyaqyjwffeskzbccy9spjiauj_jwrplgw0ahyaf1xozvm6n_fjn8q1-2vkhqqujjr1en3qej703lyxxujt6tto-ttwsl6hgsggp3ehcc"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/zjba9cvtmkfnoveyofx6gqong0kqi3s69d9o2y32fmu_gankb59tj-rb79bolx0bwbsemnonfhh2esy9olfdp-20gybztkzstfhfheqrrjuefxwiwkqws29wxm6tdobikwz-qkzfphpaldfr"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/escl6%09%09%09%09%09%20%20"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200051177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gwg8w"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200051178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yzuft&post=665308711_32&cc_key"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200051179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280"; http_uri; nocase; content:"click.message.fruit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2sm/www.facebook.com%2fidmeinc%2f/nk2-ri4n/weg/x37pnvbmkp/axzhlmv4cglyyxrpb24unjbfzgf5cw"; http_uri; nocase; content:"click.pstmrk.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/text/tab/dab/conect/1c7c5"; http_uri; nocase; content:"clickforcontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/text/tab/dab/conect/b8f9c"; http_uri; nocase; content:"clickforcontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fact-comp-h5j6k7j"; http_uri; nocase; content:"clickmetertracking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafkreidqr7tw7chuyg7pf3obkufp2hultdpoas37vnnofqes7nzkq3kqfe"; http_uri; nocase; content:"cloudflare-ipfs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/config/webmaii/error.php"; http_uri; nocase; content:"cmark.mycustomerconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/agt12/outlook"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/automotive4/hrcompliancesection"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bitflyer2/bitflyersupportcentre"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/knpdf/ussecuredpdfdownloader"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/"; http_uri; nocase; content:"coinmarketcal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#/"; http_uri; nocase; content:"comusoportecam-produccion.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/y/b6733bec265eb698"; http_uri; nocase; content:"confirmsubscription.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.../page2022//home.html#info@google.com"; http_uri; nocase; content:"confitas.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200051194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/images/verify/update/y.html"; http_uri; nocase; content:"creativeingredient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html"; http_uri; nocase; content:"creditiperhabbogratissicuro100.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/upgrade/www.connect.secure.wellsfargo.com/auth.login/present.online.wellsfargo.com/signon-lob-cons-authenticating-das-session/onlinesign-in/?online.wellsfargo.com-signon1c4d6ec1a16cf5c9edfb8804f4473088"; http_uri; nocase; content:"crm2.tencent.co.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200051207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/p/clord/eo0lfhtannnjiehfwx2q5o8b_lkpqdhacft8rkvqad2nqg?e=5%3aq65oiu&amp\;at=9"; http_uri; nocase; content:"curtislibrary-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"cusstomerservicee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accedibper"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accesso-anomalo-dispositivo"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accesso-restrizioni-carte"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appbper"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/controlloportaleblocco"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jvkvxfj"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezzamobile"; http_uri; nocase; content:"cutt.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200051216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebvdr"; http_uri; nocase; content:"cutt.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200051217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/puqg_mapil"; http_uri; nocase; content:"cutt.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200051218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmail-rd1278/index.html"; http_uri; nocase; content:"danashaymarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?d#wallets"; http_uri; nocase; content:"dapp.accessactivationbot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#/"; http_uri; nocase; content:"daytradingcoinwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hotsite/inicio?utm_source=sendpulse&utm_medium=email&utm_campaign=2021_desejoourocard_ciclo_6_opt-in_sem_opt-in_varejo_%235om-p2_p8_p16_p9_frio&spush=ywxjyw50yxjhy2fzc2lhbmu2n0bnbwfpbc5jb20="; http_uri; nocase; content:"desejoourocard.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200051222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lpbiw"; http_uri; nocase; content:"did.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/npbiw"; http_uri; nocase; content:"did.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/online/showdocument?documentid=1fce937a-ba39-4053-a83a-f07711ad8efd&invitationid=82f3e840-cd11-4da4-8579-304bd7e930b0"; http_uri; nocase; content:"digisigner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7p8ma?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dirbn"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iavat"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ot6v7?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tpjda?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w9smu"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wf9gl6"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200051232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14038722/"; http_uri; nocase; content:"direct.lc.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200051233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-wp/vystarcu/vystarcu.org_/index.php"; http_uri; nocase; content:"directlineengg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drop"; http_uri; nocase; content:"discordiboost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drops"; http_uri; nocase; content:"discordiboost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2fpushrushed88.duckdns.org%2fredirect%2f&key=ulc_4epigzz16uwfb5b_yg"; http_uri; nocase; content:"disq.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200051237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/syg9w2?snpbxu"; http_uri; nocase; content:"dlvr.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/szcbcn?utm_campaign=21&utm_medium=email&utm_source=krazydreamer099"; http_uri; nocase; content:"dlvr.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/szdj0k"; http_uri; nocase; content:"dlvr.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/18tk5qmpccb5nygfkfeo9xc5qowvffgdjvy52swoyhd8/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1_ecy_td-z_1y0ex1fkqvhikwpnujs6s4dzer66v4tp4/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1casphevkfdaz2okqj70wdai3pdwwg1weh_rpk9v0z3a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1g1hatisjxswx8aoimoehyj2gumqe6oqb8wczylqpiou/viewform?usp=forms_home&amp\;ths=true&edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1gs07chp1nmdlfpzzgcswjfzjtek057wtnfs8ws_jbky/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1htjqwgpnkonvm8dbgasjax8mkpu_pvnj0c71ttkfpn4/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1imnpkrxvkrr_kt-pytbnekp5s_cxzinmkvf6cf6nguu/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1quv0zklyhgw_4y4pfincdtzmt6qim5qffhfuxcb4kl4/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1xqimvjghvfozh7itbnfykzhs1njn2ib87dj29qowr2s/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-dgjx5xrdu-0vsevx2bd16zlt6rydibvfdsgrqlxld4lozw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-nv7qlz6jg_y9ze5k9ds_kzo8hyelurb5j5veve1q4jkiwq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc0o4vlkf8kr3nf2m594obfauspo2orpvqmat7dmhk272ex3q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc0yyqlieizg0nzouznvhsjfags1h9qi5hpdw3qlgbivm501q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc1sinntdpgo5c6tz6crpbkhdb59q9y8mjtcwfr5v93buo9wa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc3se_efrnsx26okglvyxsebmgjxvijczf6rah-bha6-ozcta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc4bagzjzmstbnjhy7zpy5zsx-xrn7reoouolv54luk5tihha/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc8ivrcjrbnxs_ckmgkrmk1unmuijsqwkbudbmayumt3e438g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc8uc5aztlek3s6dqtk1etorhez5m2yvubyw5qmfkpisrelcq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbgg1lrsb7p3ojz5zcsuhmlr4oya-ryxnkw55ae86ax56ojw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbpunbcb6ubfnwjo9jol26cjvjjsvpzkz_wb9exxt9c7erdq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbtba5srjedev4uvqq49pt3recywqah-ar5szplndj-dxhgw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscc98m5fw4ifog0zeiuquxitizmisrgsdvyxvtxsppunpkwzq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscckv1-rxhipcmrhnwfvq2lhuxx18nzcm1e7e0oz8ienixtgw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscd58n38gw0garqqds4nsmnwpsftsk33a_nkix4enivry-v_a/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlschqjqnqzdwjinfbj2v_mojjscumog6-khu8d6_qu6bmvt_na/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscirilop6_iti0zvvrlsbk8zfaeo-f10otlhj9k5liyervk4g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjsewetq_v_cbpyh9dzjwsaoldxz2zx816022wp1vej8gv1g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjtat4fmstlxz3hbfkg4qyi-epfdmun7_avcqwvgscoydytw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjvnhykksssaw-kycyrl6ywg_r3fdjuyqhk2mrmxcpgwfxoa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsckadjaoijz-t_u0iepyow3dqfxcdwzqlrk20az3i6yrebhcg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscmzyecgbuuccfs_5e5axn9hpruzskqmvseedm0xz1qrqb5vg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscndiqyfu0gtgwomcwsy-8nadvzgljrpdhkv6pedgh0avniag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscpx74rb7zxhoy5s3cpnwznbr0a5l-zomnobz3zj4sovxwbbw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscqstjp2am_gdxb3vmgu9lkv6l7jho80rmyd7lmujoarxrqjg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscrmsgjymaojts0bfneswvnfekiw6zya5rzyqoa1ydp5wkcrw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsctmueyv-hoo8lvwjhptfnaht4ymn8cr3tnftbfnqmjb6xpwg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscvqmhqgwbubzxdynzgvlbmmziyagdiadz2eyhc-s-ro8ndfq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxktatyielmhqxqqxtesa1ih5armwcrqy5r9-95cslplt5rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscy0frglrf-omcz0vkzncs5vnnwg-sbnzhqxv7fhse6pfwf7w/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscy9ghk0figbnvoyy2rdnmzbz4quhfyooo7pztytdqsoft50q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscywhsspi2neolntfe02hpq6jqilhxprhi_z58uj2lfqortyq/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsczswa80hlvnpkqiuayjwbf8ha_rqzov0iiz18iixjatmqk9g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd-1s4o-n_p_bhfqqs2agxxx4erjuvj6e5pwndokq5tg5cnzq/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd-bdmru2lv7bv1fk1mwwkxyrvf6uyx11zlly9k0j2gdse_rw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd1oa3lt2ezuxt9mjskiazk4g0xpw_krpkiy4mot2_pu1b4gg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd26pifmynauv34el3gdnx3yzwdue9bannzsfcy7bdkyfotaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd28bt51jk8onxnbburwsyu2xlc52wmdkgisnqrkvotohz7mw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd2nideystvwbbe_ai_glo93rwmxwkf_ok7sl_dvxqtacpwla/viewform?pli=1"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd2ou8uvxtpuhvfme1q0hzpsnfnwg-nfno2_niqp6fzcjobog/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd493if3zxczsfqzw_g592pog6wbhptgrci8sbhji11gq312a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd9poeb_wmgffgg8taw4z_np0kdbo32gr35k1zxizj7lcdela/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcga7ojllxp3z9puyfumhvn7klcijhty86bmhawtv5r6wwqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcznggxnwia2ct8kmxid1tdqhgerhnmixukxuj7nmq1lqsma/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdf04avkjwvete8rj-wa3i7u6_8-orwqu-c-owvgb0nrxumga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdinjm_qvdbv3roybqi073rm1pujmrrs7lid7c3qk-4xwweew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjmguhf2gu58xprr02lay_fc7kwixkq5zmtsn-5rgblqhbiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjmguhf2gu58xprr02lay_fc7kwixkq5zmtsn-5rgblqhbiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjrnxyzhrefwrp1a_7nyiqd5clbppzw_yq2ypvkuo566_kdq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdmjjljjfmjeijeyraxfm6pzupdbvoie7d_ussaqgqu2jh7zq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdn6j3pmzbohssod769dzdjgkzhq9gt0czpk41k7ovrh41rkw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdnega_6c_pz9_q9ep9epm4iwqfsrxqsnaz-j9dyldimaoocg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdpxlem5qvq23cp7vr8yithsdyn-4t3fuxcxkf4j5m5snuz0g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdqfve1h8rnbxnyd1zsnmzubwmvnzqza-o0yfbtev8e2jpevg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdqupro5hny5wbr5o5logbzdfh19mlw8vggtnzxrouoyvzkog/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdrk4xndjat7qhzawgsc96chkgkg66dcwrujwfkgjhzkmzhqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdv18eomou5hfrisolwgi5-sodwyxzdbw-x0cndwjqmorem9q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdv5owjshz-50lp-lmzff4i2z0r9sg31mh9_7b51rt-2ixoew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdw6y7nnvwnh2fqlqyk3y7x1ppoy2j8v9tlcacpmq_mqasyna/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxkjfhjk2jl99royttlqooscpgo3r9kauddp0idc_ih1g4ug/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxm-rwnv41p3wdcbtetukrctoakvuoe1h_uy8jgnxy7kldza/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdybqflfptobqslhflytic3g936bnojaljztk6ct1d5mjvnnw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdz5olqkck6id4jh4_uiuejnndrt4qwgs8wpqtdfqqtvgsqbw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdzm9zmwu3uec-1daehib24dewlqhhjqrj6ticyz5qlovz29q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse0wzdylvek6cpem3mb8zeny09jij27yj-b1p6yytyue-1rwg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3ukgwguotprcg8cfwp4kxwz64r5ogqq1j_m4ohjpop5f7mg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3va6zonlim5niyl74b8jis-o0fwno4qethj1q7rm2r5xdba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse5htthgifmniezokiypnjjhanvkvlehsrk9esgcpoauqutiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse_pppzkv1rppkqwcnttkpvx35meb94rruunhijhuua5svvcw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseaopmohwe4llodr6rvz9ybhvfg0zoqnsxzvzuqwblxhy17ta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseap64bhtbncjqllykpujyr2fa_s9yyfiylqbdnutvdu0kntw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebpakzyvtprhygwe23jlsdieyoca0jtiyy-f68nqwofparww/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecilc_5ka58gxqjfrpwbfwmhykkdly-lwm9yubx1l1gwzgpg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseck8-g3um70ihw-ajfait5whcec3qdowobizswz8_-et_jkq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecl3bk58g9ucirun7tsjpfkkkeryur6xaryenk613tqzqfxg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedam8qavfd7nwszgyriuofus5xlgrvwcojm_8jtzpiw9ud_q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedg-b07st85voaknpclg88z_zybaqffowcrxa-6eq1hemokg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseenhbbxtwamfmork3asua_pfejkhmxkqv8hlzwo-uznm3t1w/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseenhbbxtwamfmork3asua_pfejkhmxkqv8hlzwo-uznm3t1w/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseesrlhvczbnj95iwnndaeaqxw0bknkun5v1svzbwrwarhsvw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsefkdadsbapfd3db9toxntif0evefzkwazu5xituuthp9mbxw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseghb19gxs04xdkab1cubu6qmclhh_rpb2fwa8nwutpbwnkba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsegnx2irh_r_gtlspwo66pv4vkht2oobqmvjtvs4yqjj6vr7q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseh8l6dbswsdhbte62h7cjnmea1voup-3y7qhvdepcv2euzma/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsehwehncrhloyw72aebvvzvvzjrs6yz6qphpm1dvobyr8rnig/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejzzt0w_l58kpcmcq1bseqi53i0retcnl0a1-uldxvnyz-ka/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsel8uq3oplbpuz97bjyv7s-6wdghzjiaiauioimsb9buzjfuw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseo-icwia4ztexz9jczqsndvpn_la5_zoz8wkg2ldu_hm_4ew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseo-icwia4ztexz9jczqsndvpn_la5_zoz8wkg2ldu_hm_4ew/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsepe4jevfm3mjc-vndxuq_9wjpc7afrjadkxvp8czawh27cqg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseq5h3-5stw3bwnpoi6g-gfwcgej7q82incdm01dd1lf182iq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqgdmahlsb5qoaum6xdl1jhhzggtb7wiabsy3bxbmdwriwrw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqvqnxg0qnfc_qjompqm_bjbey-oivzpldd-sybsidx1syna/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlserwgqm-czpabole0qw-jg4bhicctqdjm3ex3v4vzifj5wldw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsesjc_ajwpmpcjuq95rukkgekj5y-knud2oyrj4ncetbm26yq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsevpkt1byhl-oqjptw8wbecnm7-iqnax-mz8zd-mxp0fol3jg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseylokmdm2lozwvgtqnlwhfypgqour1lomo5q9wcpb9mhvzlg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezbbqgms0nnvgk6aq0xz8sa19zyd8w87c8js99mpi3go1mqg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezxizhvg-i28_n8fyddanndnufw9veep4kk934yekxvxdmdw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf-exsf9vm0rleksdp46wa2dfca3dhphayf4tl4rktjvmgguw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf0-sqpytlsyi6uz7javookkcvby-sd4j8bc58zujl773d8qq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf0appdcwb17-g15hxqlvwdz2cngcp90uuisclz55s2volujg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf36z5diim8ke7cwmm_uobqacgk-r3w_uslnwnn60nzwqi3fg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf37osr6zds7tctpiqseyyoqpqnzaeyv704aye3atqnyhd4-a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf3wmsem7zluqpxpuwmk9qxvc5uvpl1qkhc3grlydk1ulezua/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf7rktag6kzmtxateu6hu9atx0meohtzokrqkuvn62ojflqba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfaekglhjlubx-j0s40wtk-dntowamok2u3dl24wdxhni6cuw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfdy4lqz9cxxc2z-9qldm8asxoikrw5w_jb9d0iciiyy_bpbq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfe2ymhbjhlp2njbhcnyypkh2q_svr-hjv6jakyhkrcvnrfhw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfesajj9-epeg0p0pdzfaf3xooefbwmwsn2jne-6doh86mocg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfetregzccisehncfk6344jq5ab3iq6ft0a6k_v156sh5j24g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfgejlprqaiajfduzoh8gejctdxdv-kyn38ztkb3fu6poxwzw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfgvr248yh1nbpu7vxfge6ez6e6vr66ia2m649og4_a87g6vw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfhrcintrbwx2of6w4vp1xd4fldir-qeghinej4jhsw4qzhjg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjchag9rs_yczr5hheyuc70ukrtaonxwdhxso7_qhcpp04lq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjlibrqxxpw2arqzpzumujjray3jpd_mzn_kltz7jrbc93dq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfkl2vgsks6ni0mb3-noocjqf7auguvh9lavsnwjjy2c0mgzg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfksirdejkit-tdeiwrnkf00ygsqdsqth0hmwydiqdik10tna/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfmppmwkaythtoskrsm7wewzrcamfxbeyuc6f1ewjjmzisfwq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfqf7_zc-bsb7ej4d_rikrhb3bi-o15o1l1lsa-dw0nr-pztg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfqjyamn38kyfu1gixlitpfnnivmi4dcrwllbchwywxcnmcba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrhtzc1pcighculgyjg6juret215diaac89flqhhwg0wx9aw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrw9nsla2lpenbntfmz3q_bu-6vayjudjntqikzcei2rl3ya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfurofbzbtgxzdlg7v1q6lzyf6rqi8chpmiuzmmiqmxqhzb8g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfyg4g3xanl17-4i833ep0joctptyxfsylqd3m2wujpwu1uiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfzhyjvw1nn6bvqhbwmd3rcrm6gukuzir5u9tmsszmcrr8nyw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq5dr7ajdkfwicg5n2lbhbfo85bwvgageeqmuvllkwg5i2iuhekmsvmwotev1nnzoy8xasnxerngqew/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq7oplr_-m2wcmmli5bewiwc-vkkblykry1ejy1vfvkm6c-yanjplkligavkr2dt8vkw6dmpyzkp_ki/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqceunmlqb6apzo7atraqyngn3_ydmlpxjto5ebpmdgnovp86cd8pid3_1qn-mzdth1_yvtz-rw8u6r/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqfy0klc7lmimfug7xrvape2jdz8153ptionyg7ht7va1ggm5loptsqunpgtiwn36i9y8ggrat6f7ka/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqljiqoxuypxg7a8r5x7frbq4cqcvnb77n155fzyxweegqibwjyjnpghjky3howsxyb0pe3g2wm_xpm/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqo0xukh2wuts-r_jah5nfa3jsnxxdkgvfcafnigv47ptitu24xoqtt_fhtwbm1p6wpz5ajydo3ho9-/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqopq9v2asclxkhw1tgkr3v1no0smckg8as4x6t4cyhuszvfjkaosxhp2phofsyb8ag0f-anei4kzqb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqpnti3bdqjgbzjwi0ngtojsxmdbwg61nqahtdld4z9exjm4n21xyu9nz-itwfsaitapaptvjpgn5lm/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqqcbi03ke8ybh6i0nyvaecikxaa6gdgzvgwdaygprivb_-gkvuvkvqb6hqfld9vovgdewxfkt6n1z-/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqx_zel_kuemn6sejjmr951m_x6bzzai7iqp25hfj909xoffbtw822kfnfdpl4uarmqcjov-ztc9m0l/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqywoq-kea3q3xkdnwfqqdxg368izvbbqutcjaxpy3t8duksihqmnqm70qvpl0oox5l-ijx6srgpgrz/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vr1mdvfskxsvwpevn0kbbzdj03tkd-qianser_mo-xjpu0pllzd34jz_eodizwbjztx0qsbqtch6oyl/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vr47cjjl6r4iffpd0yquj85wazh1jdtp6xpiofpjgzwu18olbjgh1cyqtfcolgtpryqmk2irslyi-rp/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrgv40o-9hv-h-te58y7dluzlgkiq2lgps9rphybq5nrrnwau-nlsnedjuazhprry10otfrh3_iq1tp/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vriyg_oiukpuguzpg2epbnyy4qjmk1v3maunksjuumfujoeerubxylo9_hltssk-qv7jsrfqfppdcgn/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrl1ylbscadiuntrkeq5xe_bz5zwgfjgao5atkkbeidhn_aqqyspym3hagxsqckazae7pwdwtgkfkvg/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrlpp6zsae7sph3l-9mdyt5imk-pe2yubomnzj6ny70klvopmcpohusaednw927gszywjusie4gjrdj/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrndlzd4qdrc7kjcsjuzzmrrr2jdhcja_8bqfaromkv4gc0xzecwkk64xdd0cqcypwk3_s_2plp8wtv/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub#slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrpahi2ri6ovz6eun9nmdyvxyen0na9v3_qjmcq-kwctc4lqjkedcbeyf4doyfx5urafpn8mu6hcrnj/pub?start=false"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrpahi2ri6ovz6eun9nmdyvxyen0na9v3_qjmcq-kwctc4lqjkedcbeyf4doyfx5urafpn8mu6hcrnj/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrrbkktbsjl0p2tdhjzjo2uawkvwbwipzqv2sgbcl7xpkns2l-hixlz_bwi0cstwntvcxq1a5r1lj4x/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrriatvgvtaoki3lje5es155asdvvgmqqjoosenskwwiutrtwubnfwgosjeuupxd5oda3gx6hbdaslk/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrv_qr8skf1llw-syahuvggfll1kvabdlhycyoyznbbf7iy2wvyjdxlynzbnimurs-rskipffjtklen/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrxxwdr6rx90gjqaynsfyoxo6zyqem0t5dkhvlps37wzw_yvtv1l-9a46qzs57vfulfph8uqh32fbvb/pub?%20start=false&amp\;loop=false&amp\;delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs4t3osol5-a2tlqhpxcbnoykx-v0xpvbkex3ikocawxpr1jez_fqk0zq8ylq7w8_4du3b3z57qhj9r/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs9iynmnt1qmlzrx07ug9wjcpumi8oop9omycxzs32_crcuz7usvufh4mzinngrsspgcofr-qq3fxot/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsfs_pk4-zigqm1bnegx_9gawv7ys2cx90o0o77ppfeimlqbtuy7wv14npitdzydmp9gnfrcjiufcyu/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsgw9oh1ixw4dhkvxkwxlwsu7de-mla1kkntrqmjmqiy0zicd42e_8eakt3kiywvfk0vrfexpkcjlmb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vskgwhr2flv0fouv_mac13jdyp5a-drx8tnnnd4soc852jjodbgozj44z7_9v5_0xlktsc10xy93zgm/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vslpj7pk4-axbccjqtpblesxanwetmsmefuchs2sloxncmvllwzftu83w_w_uia1mjemn717hwpcfnq/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vspnbijel3trkgiucqlxf7ozncbv8afgi8spwy1we3rmyp_degyrb8lt2euqyscu25c3ow_qsaa4qqd/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsrlb5wlmujw62qr1paqhiyiso0jfaxxzzlpaxtg6fgxhbg1o-q8w_fxbx628pud1ljjcxuwyrav0xb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vssxayagcehnojap_9vi4vkx2fwqtkzpgwviy2j2efosj2xfmvqmsyv1avj3eclx5wb22joceezc8t0/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vstfqvabl0hbhkiycydogunjhmqqyeh-achsm8zlhzfvqv_d7ez5x4bgpphh-es6xilbwod1niq1hkz/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vstqki4nnnyrhsn5l0tj0ec7y31bzuyy4tndmtidtdxtpbnwjjrb1nj5rjx_04hmctvvf5iu4yxhjx8/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsunwehw_cgjhia0qokxeica28iqmqaigsiupyhlfhbam7bpq5uaamqs01cucvtm8mt1j5xlc7onusv/pub?start=false"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsx8ahrvwaowtfdbywictcemrz6z1wlqenjtp97v184yas9irqjz2-axi0yov-zb9yo2o5rwe4c50hi/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsyjh3oqjp_mkyqdaub6tdi-r0ern7crtrrkktdqq6uzvearmeidpgrwvued9lf7jirwkvoi8s63qn2/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vszmxwf77cx9jec22hwonfd-l1fnnca3x407pvkw3_aanghjmyvustququfenxznzckxgaszizaop76/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtlsctrmytwlfbm8jahnsimsxwdjdk7ndptazmfi8y9togp2o8uozykkul9qp3xxeyhbco4zoeuiwbg/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtq-t3xjc_nf74w2uz3lqt-hbg-39f7xizkvxay1ngcpmau9murjkla2ye5ahoqobamifucwmttssw5/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtwkjwy3_-kl8f5w9p6a1topb1ob0r15tijqhclejlxmwtsicqxiktafoxdxkehh4tlvfye7c6xs3og/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3a5r5a92ssx38jsi"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/7kbaanzkgswcge6a"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jd4wxg8qzwd3b34e"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mt/log/"; http_uri; nocase; content:"doinikdak.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/m/mtb/login.php"; http_uri; nocase; content:"dolladayclub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"doufatin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1sf-ka2tuqr3-ievafi4ok5hjd4fsqqg1/view?usp=sharing_eip_m&amp\;ts=6302a657"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1sf-ka2tuqr3-ievafi4ok5hjd4fsqqg1/view?usp=sharing_eip_m&amp\;ts=6302b395"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1vcc1-wujbe-iacakickb5lk7pli9dhon/view?usp=sharing"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0000/"; http_uri; nocase; content:"dryfiretournament.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=2309492d735f94efd429230a6ea03173/?email=timk@p-connect.com&loginpage=&reff=mta1yzfjogq4zjdhyzaxmzbinznjm2y1odawndg1zdy="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=6c1c6cdadb2e32d8c8cf9aa93f4fb07c/?email=timk@p-connect.com&loginpage=&reff=zmrlnzazztm4zwjlyzi1mtnlyjg5ntexzdg5nzvhn2y="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=6d20ca503b5a0af2f92f3cf19955cb13/?email=timk@p-connect.com&loginpage=&reff=zju4mwjjmwizmddkodc4yjc2othln2zhn2y1zdk5nwm="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=6d534ddb031fd3806a7fd8b85505c292/?email=mplasker@vericept.com&loginpage=&reff=zwe0y2u0mdbiytg5mtm4zjliymnhnzlhogiyztq5nzu="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=775e967f814116889dfd1e9c545561b7/?email=timk@p-connect.com&loginpage=&reff=ndyzogu0y2fjzjbkzjdjzmi4zwy4otuzmjcznzjlmge="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=mplasker@vericept.com&loginpage=&reff=mjg4mtk4ngnhnjflymq1yjk5ztg4yjy5yte3owi4ztq="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=8728b22d7a2d2fc408ce72184c47c558/?email=timk@p-connect.com&loginpage=&reff=m2ixnwu3ngiymwjimtq3ymuzntiyowy2ywvlnmfhzwi="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/js/cmd-login=fc57e7f7e3afa9af443c1aabe31bde5e/?email=mplasker@vericept.com&loginpage=&reff=ndyzogu0y2fjzjbkzjdjzmi4zwy4otuzmjcznzjlmge="; http_uri; nocase; content:"dssurvey.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200051523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lulu-hypermarket-careers"; http_uri; nocase; content:"dubaivacancy.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200051524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/customize/ingresoseguro1/"; http_uri; nocase; content:"duet.ac.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/aruba.it/aruba.webmail/arubaredirecti.php"; http_uri; nocase; content:"duobabiji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?ref=agfuc2pvzxjnc0bnbxguzgu"; http_uri; nocase; content:"dyuvstyfawecteraw.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owa/auth/logon.aspx?replacecurrent=1&amp\;url=https%3a%2f%2feast.exch082.serverdata.net%2fowa"; http_uri; nocase; content:"east.exch082.serverdata.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amp/29559-vente-flash-le-samsung-galaxy-s7-edge-a-prix-reduit-chez-orange.html"; http_uri; nocase; content:"edcom.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200051529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn"; http_uri; nocase; content:"eeverywhere-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m&#61\;0"; http_uri; nocase; content:"eleoelswka.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?u=5tlkgeu&amp\;o=gqfpqzm&amp\;m=1&amp\;t=th_ppp11"; http_uri; nocase; content:"elite-ladies-here.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200051532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2ftilbakebetalin.wpengine.com%2fsw%2flog%2f&data=04%7c01%7c%7c11af7bbcb8534b33863408d9e17cff46%7c84df9e7fe9f640afb435aaaaaaaaaaaa%7c1%7c0%7c637788749239190942%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c3000&sdata=wyye%2fyjymouztvtdzw%2bfpfpyzj4nrvzhvloufqhq128%3d&reserved=0"; http_uri; nocase; content:"emea01.safelinks.protection.outlook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"eneeeetsowww.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/atandt/index.php"; http_uri; nocase; content:"equiconfort.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200051535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%2bsjfgzhadhvte2gyowjf83iqbjrjehik4s%3d&docid=1_135f7008dfbfa44e6b09dab0eb165b997&wdformid=%7be037f2d9%2d5daa%2d4916%2dba03%2deb11d0aa6dea%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/app/gbwa/image/transformer/4573be1d04074ebfab8fbb16f21a65de"; http_uri; nocase; content:"esa.www.wamodshost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/2022/-/load/2fb8b0994e6db65ef9b701f0ff58641a/execution.html?validation=e1s1"; http_uri; nocase; content:"esnafbenim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxzqtupytrajanouyatyt"; http_uri; nocase; content:"espace.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200051541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/t/43431940/1624857538/56733586/0/109770/?x=022e1138"; http_uri; nocase; content:"estadisticas.neored.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html"; http_uri; nocase; content:"eu-001.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17369aa91d5549c192b0f736d5822403:rr-frontpage/index.html"; http_uri; nocase; content:"eu2.contabostorage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice."; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn"; http_uri; nocase; content:"excelelectrical0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lbpiaccess.com/"; http_uri; nocase; content:"excelwithsmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r?us_privacy=&amp\;a=p-w_ayumw3pzr2w&amp\;labels=_qc.clk,_click.adserver.rtb,_click.rand.60541&amp\;rtbip=192.184.70.137&amp\;rtbdata2=eaaaiencvf9odwdnzxrzx1e0mjfftwfuywdlzf9tzxj2awnlimofncj-jtiws_b-ohnodhrwczovl3d3dy5syxcuy29twihbt0llsefpmvdcvwi0vmdxvi1julfbztjdullinvfzuuitwjdutjfpdu3bfukaayfd3aqeoaebqahv4fyeugeawahq-aniadv5u4til9obfllxavhtz0fpaghnqs1sufktuvntqkhlaarzydroawsyaviznracclocbmc4ronaagliagdqas7hhvv4n_fmqqhgagdoagd4agckaxywlnb1yi0xmjyxotkyndq0odazodc1mamaqamasgmejmh7angd_dgd4gmpcc13x0fzdu13m1baujj36gmfcngfefryawu5mjeymfgdaiaeayoedxf1yw50y2fzdc1xyzhybajvuw&amp\;redirecturl3=https://www.cbtnuggets.com/?utm_source=quantcast&amp\;utm_medium=prospecting&amp\;utm_campaign=general_us&amp\;utm_term=testimonial&amp\;qc_campaign=cbt_nuggets_q421_managed_service&amp\;qc_adid=2078771"; http_uri; nocase; content:"exch.quantserve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html#map1-7"; http_uri; nocase; content:"exodus-10exit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.aayat.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200051552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.adnansohail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.afrikaanagroup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.ahsaniman.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.amirulkhan.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.anakfarms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.analengineeringworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.andreealazar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.arkan.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200051560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.audito.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.balochistanot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.creativetugs.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200051563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.designliquide.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.digiserp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.digiserp.marketing"; content:"Host"; http_header; classtype:attempted-recon; sid:200051566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.drinktolife.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.earkan.sch.id.arkan.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200051568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.eps.school"; content:"Host"; http_header; classtype:attempted-recon; sid:200051569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.fa99.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.hetothem.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200051571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.hrtrainingme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.i-teleco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.imbrine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.imorganmemorialclinic.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.incrediblestrikers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.ismglobal.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.jhalakstore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.johnsonlandzro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.juvehaircare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.kaoserschool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.lifesaversinternational.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.madopick.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.mandbryan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.medspharma.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200051585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.mihranllc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.missionsaveearth.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200051587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.monilier.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.nulltechnologybd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.pariwisata.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200051590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.procremax.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.procremaxtwo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.promaxz.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.rahmafancylights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.rvrentalssd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.ryansresidency.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.samskebabgyros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.smartpackqatar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.softasol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.sombirvisaconsultancy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.supacapherbal.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.supacapreal.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200051602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.svnetramandir.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.taleemo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.tdxinsurance.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200051605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.theinfinitygroup.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.uniportsgs.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200051607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.vedichomes.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200051608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.veeonway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.web11.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200051610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unlock.html"; http_uri; nocase; content:"exodus.com.merge.zongotoday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hksr"; http_uri; nocase; content:"fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200051612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/investorway"; http_uri; nocase; content:"feeds.feedburner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gv3er54g0-93w-er4jgf-wekm-vfcn9we-rnfgv-w9rnjgv-wr9v.html"; http_uri; nocase; content:"fg3erg0-f9w3r-jgf-0w3er9kfv09-ewnrtg-0ner-0g9jn0-rg.obs.na-mexico-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hyf90384r0gfhw3r-ehfg-0wrehvf-0hwrf-0vh-rf0hv-0hv-0rfv.html?awsaccesskeyid=ry9rplphuuep0rwre8s8&expires=1666191545&signature=j2dfaszxfyvlmfo1eawyvsxkc6o%3d"; http_uri; nocase; content:"fghwe803r4hfg0-whre-0fgvh-0whv-0wshjv-0jsd0vjh-0d.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d#hughesmichaela06@gmail.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/cardilogist91983.appspot.com/o/index.html?alt=media&amp\;token=40dc7341-52e7-495f-8ba3-04f739b67ca0#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/gho2408gen.appspot.com/o/%5c%5cgho2408gen%2findex2gho_obs.html?alt=media&amp\;token=269e2a71-4a9c-42da-a207-2fc31ff7f812#mohammadahmed7760@gmail.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/nnnnzzmbcmmm.appspot.com/o/index.html?alt=media&amp\;token=ff8efd0e-8cdb-4767-998b-f421eee08f97"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/okorocha-9d683.appspot.com/o/indexxevol.html?alt=media&amp\;token=f9ee1486-b8df-4f55-8b9c-466fcdcf99a9#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/pass-up-date-now.appspot.com/o/update-update-update%2findex.html?alt=media&amp\;token=d3144df5-bf15-4058-a0dc-9610b1a9193c#email=info@domain.tld"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/preserving019029.appspot.com/o/index.html?alt=media&amp\;token=caa885e7-5275-4bde-bc3d-a3eb2c95dfee#r@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rtzmthtcnncttoaccs.appspot.com/o/index.html?alt=media&amp\;token=8d757dc9-62a7-4c67-b241-997916e540f2"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/scnzmaccsscnncttw.appspot.com/o/index.html?alt=media&amp\;token=fe08a148-55d4-4bb8-8d3a-53479440818f"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/update-d2e45.appspot.com/o/update%2fupdate%2findex.html?alt=media&amp\;token=ca2d4bde-8124-4812-9c7a-1ff88eb47549#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/zmrtlvelo.appspot.com/o/index.html?alt=media&amp\;token=18cfe488-1dda-4f65-87ba-3073a2ea5d0d"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/lewis_webb_firstfederation_org_uk/eid78dus_cfjrrv2swyzp-ob1udpvku1sjneglgmz_0zwa?e=dcj1hk"; http_uri; nocase; content:"firstfederation-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imagex/ahr0cdovl2fscghhlw1hcmtldgluzy5vbmxpbmuvb3b0dxmvymlsbc8=v"; http_uri; nocase; content:"flackbox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dike"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200051637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13c1ofsbi?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13wrz1ibd?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6hcovwa?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6jiqmub?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1sbjwytzo?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1scqelfiy?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1shwmjpay?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/3ztlklevg?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/jsoo0zbqr?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btalertnotify"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btbroadbandnet"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btinfonetwork"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btinternet947847"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btinternetconnect9280"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btnetwork735300"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btteamalert8575"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/dixatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/hip"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/j50"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/s21"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/xpsatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221027503251138"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221186654354155"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221295519236559"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222425861915155"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222624132806045"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/222783091600451"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/www.microsoft.comen-usmicrosoft-365onedriveonedrive-for-business/webmail/home.php?reason=1&trk="; http_uri; nocase; content:"formacion.accesodigital.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200051665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1mqqu8exzgpptqpl8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5wjuv4glrx78xun4a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8epxhwdapiab7mfw7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8oszgml1rvofdvtv7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8vb7wfyzcoeb6vvj8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9bwawhpz5vi7ilpe6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/akohiguxjs9wlpu28?sllqm"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b7lqaal42juffiw1a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bfz2l7i3wvrp5heb9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cfqg5uz57ehywkhp7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cqzwfmqvrsnm7wrq9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ejefrdpmyoad4gm58"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eozlrnnf7jh84xdp8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fc47eidpg6e64gkt5"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvaq9zhxfhgqbusw9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/giwukhx8jkyq4jw7a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/goerpntl5tfeumdz6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iai7pzm4pxyb145i9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jzxtb9auexgjcewfa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kadtekzswcevrtz38"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kehch96avaku7oey7?akowgmooutpwa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mpkhrpn3jc8pqv7j6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mwctig62j4y5mgm3a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nokye42b5qkubgnt9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qxxe9xuu3h1lgpyc9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rwpcmhm8vtfa7f4m8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sj21ehdebhkcpvfv6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/smufgmyhduckbq6ka?fjxhgyroek"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/swwpzakt11x6mtt37"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uqzzznxv4cfhu3yr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v5xtnywt5s6zvpp27"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w6uh9p66tdq6l1m66"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x3aasffazsrl8pcr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxjqmu6luzkpnalg6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200051702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276/"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276?r=use1"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/deef05667ad4b4a16abdf4cb6da54137"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=95vlqxxdseiozn16dgibdsdprn5ritrknkwe8o-kcqduntbduvdwsutpqzzcmk85mfdrsjk1u0pats4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__gdpmarun1y5qlrqnjbkuvlhuvgyu0q1q1axszg2wi4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=ohdyclicseeuggrjwocnyc_obsknc9faprsbco6mlnhurtnevvdzuzzewddiq0xoskixulbontdsrs4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/ne89gvwrye"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/247michaelbryan/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pattles066/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/traskray168/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/armandb622/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mucmddc993/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/confirmed/index.html"; http_uri; nocase; content:"fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/folder9/adobe-3d6/"; http_uri; nocase; content:"freefantasybook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/help.verify.html"; http_uri; nocase; content:"fvhyrsxzact.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gov/montana/mtgov.html"; http_uri; nocase; content:"gawayu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/list/"; http_uri; nocase; content:"generalmainnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/03e57d0f53be41a0e5eb41f4e2402336/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/20ab8e30e385c40520f941ad089e2899/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/3e3e25122ef0c8132f4a4960b3ffb225/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/4310938c744d6b44ce2e3ca0ee1c8ac8/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/8d1828b552a9deae3c010b43bf4ac857/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/972bb3affd42828121e2bed39a7a981b/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/e837ca1b77e6a3cf99816ccf45c05157/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/e8505fab92eb230c20314c7df8d276bb/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/f42d98591df0693e132091b83eb94aa0/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/f83abe3fd6575b7f6916fe0c62a02c4e/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/dir/f8ccf4092bec51f6a0b14048d43bed67/execution.html?validation=e1s1"; http_uri; nocase; content:"gennou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mylogins.cso.web.com/"; http_uri; nocase; content:"ghlexperts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2022/01/daily-rm8888-shopee-1_23.html?m=1"; http_uri; nocase; content:"gift-1212.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/stephanb_lmdv_cloud/ejoj3wrymuzcqlmmuvqlvkubvf_p2ndmcd7cqs_wr6ltwq?e=frtqmz"; http_uri; nocase; content:"gmdco-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/free/?elqcampaignid=9288/"; http_uri; nocase; content:"go.docusign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fez46yyrvh6f0bbehn8h419h&amp\;persistence=1&amp\;checksum=069f46345ac935567ad562a3d64a332066064c97f8feae803d555f9cc820c561"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fezncfbjbj86yneatjn0qvt4&amp\;persistence=1&amp\;checksum=8142350e161acc6cb246be1d05d596973a1d3ac50af1f3594ee9ea462c87a4ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff06m6n2q43m6zcaqrh8xpm2&amp\;persistence=1&amp\;checksum=26e140f8abae23dd0c8dd547390a4deb9fc54b1acf3539d8aa44fb19e04902ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff0qxy635yfpkrdaxav47j5k&amp\;persistence=1&amp\;checksum=cb2e0f7328d6ffea0e15a24046095a0bb98d27d4488e822bea4b181763f2eb0b"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aksf"; http_uri; nocase; content:"goo.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200051742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ery0xc"; http_uri; nocase; content:"goo.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200051743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#1lwkr92k20x&sa=d&sntz=1&usg=aovvaw1sjseir4b0q4l8sbg3z3us"; http_uri; nocase; content:"google.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200051744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?hl=en&amp\;q=https://quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com/aaqkagm3ztm2odcyltawzgmtndk3ns05zjuxltixzmyyyznkntexmgaqadpitonhie1hjl70qeb7vdi-quarantine02719message283/quarantine.html%23pimo@apms-ltd.com&amp\;source=gmail&amp\;ust=1654842023923000&amp\;usg=aovvaw3tlbzf2sxh2-mtjs7iurao"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?mo=78986685794&q=https://c1r.at/h49xmdcp&zp=5095739289&kf=59242331&sa=d&usg=afqjcnf_3jyqkupfmf1gle_0jmhtak3s0w"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fbit.do%2ffsgjq&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngvqc30z-4hiaizv03gpwblwu3vnw"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fcanarytokens.com%2farticles%2fterms%2fimages%2f6273376tgy8lrrnek9ai08a01%2fredirect.html&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw20yd4y6h3k2ostqzlu8pmd"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http://nouvelles-hybrides.fr/wp-admin/general/hhhheng/hhhheng/hhhhh.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1648980902684000&amp\;usg=aovvaw3lj6xdrkr7te65my0ifv8q"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http://www.customer-portal.info:8081?rid%3d92360zx%26pcode%3dpztnt&source=gmail-imap&ust=1664953377000000&usg=aovvaw0vpjehqhb1nmi-zmwqaqm2"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f094847.webflow.io&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw2kpvsektuckv0n_xmzf-pi"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f420-cz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw0wjz4j_nhlgaiurii-nfp1"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f51.fi%2fai6n&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw3ztrphk75w64vrj-rkdbza"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fpo9cz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcnec0vbdyqyotdsbz7gijk588avcwg"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2ftestwordpress.top%2fwp-content%2facaynumpang.html&sa=d&sntz=1&usg=afqjcneq22nczpte3zh2zdvetbj9kx5z1g"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvip.91234567.cn%2fwp-includes%2firsapi1.html&sa=d&sntz=1&usg=afqjcnfo-ujbo-tnv5d6why8olvgunjxjq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvk.cc%2fcbjxkb&sa=d&509=848&usg=afqjcnec4gkgoe88ifnjjrnagnlez6uneq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://393512dfd8544c98be9a40f2f67df8bd.svc.dynamics.com/t/r/a7uua5shyiplufx4zj7f6u2clgtguiagoxngfoio4am?clientid%3d70000%23%5bemail%5d%2b00-70000&amp\;source=gmail&amp\;ust=1636719774661000&amp\;usg=aovvaw2fsk8htfwhsfqapvbu674n"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/fzleuule&ry=9080899&sa=d&ha=9992286639&usg=afqjcngde0oxaxjtp-semb24qndyxqpfeg&jj=95316071"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/n62bfdcp&od=3896761062&sa=d&usg=afqjcnhmj6a5ejlmnfnws314axi9thcopa&qw=69345649672&rh=90290680"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://shiny-field-9548.on.fleek.co/?node-hash%3dqmzx2h92h51hopkxgfoaxkbjsymzqxuyxyfkw74s3qgcf1%26ci%3droy.libarious@alsaad.com.sa&amp\;source=gmail&amp\;ust=1660041395315000&amp\;usg=aovvaw1qsi_dkkhcsntjrcbe6ewe"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#sx0z5vskhyx&sa=d&sntz=1&usg=aovvaw3wt2smooknv0nq-tlwykit"; http_uri; nocase; content:"google.vg"; content:"Host"; http_header; classtype:attempted-recon; sid:200051762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=https://webmailn0s9344.myssomailsecure-srvr3.ws24.biz/index.html?submit=redacted@redacted.tld"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/auth-here/"; http_uri; nocase; content:"gophomet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit"; http_uri; nocase; content:"gormanusa-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/12/window.html"; http_uri; nocase; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/.../?i=i&amp\;0=info@google.com"; http_uri; nocase; content:"hatocorozal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"hdfwetu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0009977323/"; http_uri; nocase; content:"heylink.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/id/index.php"; http_uri; nocase; content:"higherselfdevelopment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vpib5oq/"; http_uri; nocase; content:"hotm.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200051773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wncom1b"; http_uri; nocase; content:"hotm.art"; content:"Host"; http_header; classtype:attempted-recon; sid:200051774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://dplux.com.ng/cgi-bin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://free-url-shortener.rb.gy/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ib.adnxs.com/seg?redir=https://secure.adnxs.com/seg?redir=http://owl.li/pphv30sb9tt"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://m0-online-infov4.duckdns.org/auth.php"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://trimurl.co/0wsx7z"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://www.aquarelle.es/tienda/ramos-de-rosas/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://yuzurihah.duckdns.org/9e9q1tj?userid=yl3czfei"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://aratera.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://bestanimakers.com/fwdirs?irs-gov.data=sa01331mnq"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://performancelocal.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200051785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"//ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li?https:"; content:"Host"; http_header; classtype:attempted-recon; sid:200051786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bids/e6v/index.php"; http_uri; nocase; content:"hustleprayrepeat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/#cnbpzxjjzubyahjpbnrlcm5hdglvbmfslmnvbq=="; http_uri; nocase; content:"hygocart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebuse/servic"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200051789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webaccountupdate/stockholmsuniversitet/"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200051790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prostars/index.html"; http_uri; nocase; content:"idola.net.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200051791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verif.php"; http_uri; nocase; content:"if0rm4s1p4gec0munit1ac0unt.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200051792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mdkea5ckpozm/click-here-to-start"; http_uri; nocase; content:"ifyufyujk.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/e"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btbroadband/bt_broadband"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btin/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/fgjjm/1-xp"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/iuhj/kay"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kennymoore12/btinternet"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kfouo/btcommmms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lasodi2/attworld"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lobby02/attusers"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lofty2/mobileatt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/bt_mail"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcomms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcommuni"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/att_word"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/attsusers"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-31138d48-omsttuer"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/css/api-ganz.php?key"; http_uri; nocase; content:"imaninet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"imcreator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/emailupdatee/owaweb"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/webmaiil/accounttportal"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/238eae4e-7809-488b-8a61-99e7f7b20111"; http_uri; nocase; content:"indd.adobe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/js/net/"; http_uri; nocase; content:"injazrest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gov/montana/mtgov.html"; http_uri; nocase; content:"innerpowerjourney.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index/user/login.html"; http_uri; nocase; content:"inpusdt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/plugins/ingresoseguro/"; http_uri; nocase; content:"institutomobilitat.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200051821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1cxrrh7-"; http_uri; nocase; content:"internetservicetech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/landingpages/214dde44-d83d-472c-808d-4304cf3e308c/j1cxrrh7-%20a99jcpazg1u1lchzsks0nyx0reukftnqsc"; http_uri; nocase; content:"internetservicetech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9g9h"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200051824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9git"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200051825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9gkk"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200051826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeia6ano5rwklrhhxag3jyadrix7slh4v4wwo2g3xwsdowd4rx4eulm"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiacr6ny4gqer2nnmp4d2qujxpfvtjcqtqrloqqlubkpufkc3vo7ly"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiagbszmg7i45qtecbq22b2qssbfloccz2w5jlblcdrpd6pe4grnom"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiao4cz3ukl77rw54haby2ewtrlbydwkce7qd6bon7k7jathvzjo5u"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiaubpj6fbskqqmkcktn3gss5i4w26po2euijdxvsm3putylsn7eom#abuse@ethz.ch"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiblg2hkuyf24md6qubrcu2omofpdgb73aoukpafsqkpflxjby3fum"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeic4olp55f7k6djfpg7atntw4x4ibo2t3cxbtxpvf5ptvgdzrjmu5a/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeickox6fgjgaccllg65ly7svr4dr6chbvzjqn676cu7bu5lpoa244q"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeicqyn6jliwpp5zfl4ybbuvx67azwr65vg4ssd3teg7rfozfusoipi#redacted@ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeid2qwr7aat5nikj5ymfa5ln5mwpqymr6tfpsw5cojr3qfc277ig6y#hgasjdhagjd@outlook.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeids4xhynguua5fkrr47trwe6i7eqrq2cjmcor4afva5t4fcql7oa4"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiew3kqovi4w24krkzgf55ov7kpzz4cr6jwmvabinvgnqh3ipkrhje"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeifatiflhlbavi2sdhdupez3scj2sx2nagussxzjbtlqtdudwexriq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeig6ejnuun2ejcz4uuztn3r3wahbfb57qbyeuifoflixoq3se3e43m"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiggw63lcdef5tsis22jkixcza42ong35tmbrxjgrvkuzpmy7qn6iq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeihm566ce2hlr65n7bdmgdh3wfj7ikw2vvnwv3gehbtyqq22xwtrqy"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmap7f2zzcedqqbhxtm1ymah3jakkpdqyhbdfoteu938sf/#webmaster@cuni.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbtirqa8ezbj2rhbjd7bg8ncingx4hjcurnmul6dapx5a/#"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmcuhgyqoswz2utjswxwclrielscuyypppthpj2pytr8rl/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdh8cdcnwpfj66wzfsi8bmobabvehreffj3uet1v4obzy/indexchu4eg.html#redacted@ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdumuhtw4u7kj2p9835yy5xh4f1lu9q9g4zgyoeamy3ji/index0000.html#vanicekp@utia.cas.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmejokdqrqrzhbmrxfz6ow3zochj97duyzeb597rvzbkf5/#user@domain.tld"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmejokdqrqrzhbmrxfz6ow3zochj97duyzeb597rvzbkf5/#webmaster@cuni.cz"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmnupxxp2cormsngrdgtjtxft4bzvdej39r69sw3lt1xye/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmslqbrttddxelfst3nnhu2txkjxlxqtncgy12wduu3e5t#a@b.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmslqbrttddxelfst3nnhu2txkjxlxqtncgy12wduu3e5t?filename=ionosmail.html/#abuse@ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmslqbrttddxelfst3nnhu2txkjxlxqtncgy12wduu3e5t?filename=ionosmail.html/#redacted@abuse.ionos.com"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmz5sbvvmwzjbvcgym4qdbh1slalfgakuztx6olwcnjimm/"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiapykp4evlxstpgelo46q2qzt2iilknodnlkiln4d7tzxlrwddsoq"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiegf3yno2h35lgyvv5c5x4pnsb6nsgbmddh6v6u63wc2623yipp5y/v1.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeieqrn6uqygfzyy2wc6xaq3xdmiuj7y3th2znwt6ttfhidlnwcxyiy/frem.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeigm5qo22yyrrtfzvwc56k2ll5xoez4xbeww3eilh2an5il4jteate/logvg.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeihnjukmlitgkexrjkt74i3jnlqxfbcq5vsbdo2akvbq5lbxdmqfz4/freee.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmb1h8ssmu9zuqka5jssddptz1lfifxlo3cyjhgwobtpjg"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbuzpoyfqdvxykecupehhes4r5cuf8wws8mgb3bvt7qs4"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbzhqkgkbcn8dxqija8v1kw1hy9aghqlkm3jvaalw2q7i"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmchtpiajkcpf74pjibgbvjlxxc7cu1v4p8dzebobfjtat/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmcmxmhkmfqzfl71dtuevuidsye6w5e5rzivoeoqeakref"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdttrfmgigpkn6ejhngr46x9wpavrtunis6hcdkl7rnlu"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmdwwozfj9izkpqarjxkn2ny3iswfrtfsssxjqpscdgpqf"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmebhkt36w3jfrll2k4jevvpvsniym5nessgtvjuaqjxje?key=bf38df4466e9cb6870142585341d7c28c4be5cba&url_01=https://asserta-honeyedly-toom.s3.us-west-004.backblazeb2.com/index.html&url_02=https://climacium-opuntiales-retar.s3.eu-central-003.backblazeb2.com/index.html&url_03=https://equalled-hylodes-penmanship.s3.eu-central-003.backblazeb2.com/index.html&url_04=https://keepsaky-samiri-subcyanide.s3.eu-central-003.backblazeb2.com/index.html&url_05=https://eccyesis-euge-splatterfaced.s3.eu-central-003.backblazeb2.com/index.html&redirect=https://www.amazon.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmekd1n6ascgiaw5uxlcu29uldwq2fqaifqkaaweg2lauz/#a@b.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmpr7pxttqb42sb3o4purvmpdhrfnetb4d7ypkpj1buudv"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmptyujeuvgabfk5uqnnskttet4qdljidh73psqk9ab1jt"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrezwq7szkkrw9bdjef61yavk6ceia9qzps1msnvv1ncc?filename=montanews.html#abuse@ionos.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrhpfgn74c9yxxssli9vksdmradxtr7tmvfmfn88dyzan?filename=index.html/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrmjv3y85oqzpgcajrcha63uxguvsdglpjzatcdym8qgg"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmrnherc4eg3rbudu3gxnw9ftxhermswijyqxckyqv9nnh/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmt48wpmtzop9kuxbdwgsbdye8ysfscsvxqjafw7mz1md3"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmtha69b8i34rargrxhhcth1w5sxtidwlvcml1qz9e5m6e#a@b.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvdofqugtjulbn5tfjzkadkcrphujyrskxubejxvgeomh"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvjafpnmiojpw8fc8vwheabqvyhaezve1l2kadaqzfznc"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvwdakl81jn6t1gtdkfnzqdg7jphvslc1htnzxhwetxzq/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvzommzxpatyuyj9vinhyqvhedsq2i3dqcxhygenfahhn"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmy7cutgbk8xjdnnm4tehjzju37qax8xq7utt2178er6mq"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmzpyfbe7zxt7czzx8q4rbv3mm6msguaczwktwbbzsbgv3"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200051882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmuzun9v7rhzwt2ug9fybgjk8w6msvk1ma7s49y1qkmblm"; http_uri; nocase; content:"ipfs.runfission.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/08lvks?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09x77b?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0vabld?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1gvaja?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2vj92g?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3clukh?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4otmb2?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4yxy1c"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6o9wzz?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9fruwx?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9mhuxm?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_b_p_e_r"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/afaaoa?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/am10ch?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6rwz2?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bloccadispositivo"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bper_alert01"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bper_banca"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bper_banca_sicurezza_web"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bper_sicurezza_web"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bpzqlb?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c3i7et"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmvxje?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ctky4d?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dispositivo"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/duueet?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f0ttv6?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f1sdet?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fopkyp?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fywrlt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gimn7a?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go9ob8?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gsprzd?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h0x9vt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hh3iac?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hh86ur?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hpbvl8?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hvtcje?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hzqseh?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ifajc7?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipzg4z?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j0evku"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j5rfag?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jonryf?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jzpj5l?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ku1m39"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ljxgs1?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lmkc57?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/m6ejlv"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mari3q?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mltkf3?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/naf7nw"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ngwstd"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/notifica0909"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nqwlvi?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portale_b_p_e_r"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prpi5s?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qgrfle?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qpmfoj?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r5chbr"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r7ifgg?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rbqscn?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/revisione_anomalia_dispositivo"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rwdiwt?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shwcbr?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/spedizionesicurabper"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tq7av5?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ujzct0?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vao6qp?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vohdlh"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vojehg?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w4rw8r?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wq4c3e?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xhvdb6?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xogi59?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/y6ed3j"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yoqgmk?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yvjzbv?confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yvydpz?facebook_security"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yzp976?facebook_confirmation"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200051963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/johan_jent_se/_layouts/15/doc.aspx?sourcedoc=%7beec8258f-a831-42dd-be37-a7186f3b17ee%7d&action=default&slrid=46cb5da0-f097-4000-fa3f-ad6d18add717&originalpath=ahr0chm6ly9qyw5zc29uzw50cmvwcmvuywrhyi1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9qb2hhbl9qzw50x3nll0vvogx5tzr4cu4xq3zqzw5hrzg3ri00qkzlswlowfbjwfp2c0xncgiydfnpz3c_cnrpbwu9b1dcnljfmkuya2c&cid=5712c764-51dd-4b60-bae5-9412676adf48"; http_uri; nocase; content:"janssonentreprenadab-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/dhankins_jecompanies_com/ezmchome9sxbl4kht3dj7mgbxdck6dbig800tfkd1szbja?e=dafgln"; http_uri; nocase; content:"jecompany-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200051966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost/"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200051967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/code-eu1.jivosite.com/widget/jqqceif7de"; http_uri; nocase; content:"jivo.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200051968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/first"; http_uri; nocase; content:"jreast.co.jp.waizao.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/second"; http_uri; nocase; content:"jreast.co.jp.waizao.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200051970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7euow"; http_uri; nocase; content:"jtbtigers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/js/apibiji.php"; http_uri; nocase; content:"kangaroofruit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"kduhgu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200051973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/contact-us/2970503358622564"; http_uri; nocase; content:"keap.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200051974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adobe/"; http_uri; nocase; content:"kiandainvest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_internet"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200051976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_service_alert."; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200051977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_teem"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200051978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4668bd15371dee754cc64ac461f2c7f6/d01a8d60b7aaf39c7fb5c0b3012a739f.aspx"; http_uri; nocase; content:"kolobjut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?pandora&amp\;sa=d&amp\;source=editors&amp\;ust=1665198239858988&amp\;usg=aovvaw1-rch8iocyyq4lfpneqymr"; http_uri; nocase; content:"kolobjut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/modules/ps_contactinfo/translations/"; http_uri; nocase; content:"krateczka.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200051981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/modules/ps_contactinfo/translations/swc/swissers//manage/phone.php?session_id=c5cbe2ec86dd9cb69c676c37e3efea49$c5cbe2ec86dd9cb69c676c37e3efea49"; http_uri; nocase; content:"krateczka.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200051982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/?clp=327598322"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/seleccione_medio_de_pago.php"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html?"; http_uri; nocase; content:"kryptoconnect-support.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200051985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7vrs"; http_uri; nocase; content:"kurzelinks.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200051986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l3leph"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tbjbos/"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200051988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtanx/office/index.php"; http_uri; nocase; content:"kuyhaa-me.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200051989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amazon-account-locked-id9517453"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amazon-signin-lf4nnwapv3xgyj"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbxhz"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdczsh"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200051993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/eduz?userid=nwwuer4j"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/een1?userid=gkywgnp7"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/egic?userid=urrtk9bo"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/ei3z?userid=nl7mbjhz"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://bit.ly/3mlmufl?trackingid=asgfti6f&signature=newsletter"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://gorkha-uae.com/hrrmxpmk?dt=1"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200051999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://qrco.de/bd7zkx?userid=lp9u3b16"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=g8tmk6cv"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=iwhzddbk"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a0n"; http_uri; nocase; content:"l24.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200052003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.html"; http_uri; nocase; content:"lbank.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200052004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/627d1ee47d4cb80020d558aa"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200052005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/62985118879fa500156595cf"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200052006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775023202038908798224799741048384569091345201682&156525270371383915440398294418924174176339638&estelle@steinborn.com.html"; http_uri; nocase; content:"leafblowerguides.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775023202038908798224799741048384569091345201682&amp\;156525270371383915440398294418924174176339638&amp\;estelle@steinborn.com.html"; http_uri; nocase; content:"leafblowerguides.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2022/09/sim2.html"; http_uri; nocase; content:"leroudemaroranaa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/match_login/match.com/match/login1876.html"; http_uri; nocase; content:"lifeiswhatyoumakeofit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sw/w_11.js"; http_uri; nocase; content:"lin01.bid"; content:"Host"; http_header; classtype:attempted-recon; sid:200052011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/a74a48ad/ghnsf9jjv0_e2miyubuqpq?u=http://www.kntrwyy.radiomanantialesdevidainternacional.com/%23y2fybg9zlmdhcmnpyub0awvycmfhbnrpz3vhlmnvbq=%3d"; http_uri; nocase; content:"link.edgepilot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/40601p5zynl"; http_uri; nocase; content:"linkfly.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200052013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1rvqqm"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8nyk33"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9onwxq"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assessoriabvonline"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/atdminhabv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bvha"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/compassvisatteam?fbclid=iwar1y_woca8bfs4hb6doiqhzlulrfftr9ibsoxqbhrfckwlghzfxe2en2n6c"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cungrationoficial"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupommagalo_2022"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbsi.id"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fguugio"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hdyhid"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hifyiu"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ihkl"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjg"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrpvy"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mssdxd"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nuinvest"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nupagamentos21"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pagamentos.a"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/paneladepressao79"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portalclientebv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/promocaocasasbahia"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qk1m4v"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rubbishrubiish"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/suportedigital2"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vv06p6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vvolr6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w1p0l6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/woo3x4"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahuumail"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yhooooo"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200052045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupom-americana-site"; http_uri; nocase; content:"linkr.bio:443"; content:"Host"; http_header; classtype:attempted-recon; sid:200052046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accountupdate12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/activitlogs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adamson12345"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/admin__"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalert"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalerta"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alcorbeil503"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertadminboxs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertadminupdate"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertboxadmin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertmoreadmin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aoladmin_"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appiesecure2021"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/att.net12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/att8"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attaccntsachieve"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attmailuser"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/britishtelecommunciation"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt.o.world"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt45y"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt5644"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btcreator"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet21"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btsecurelink/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bttlee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bupporrrt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/curr0"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/currentl"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfghjkjhgdfgh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhlpackage"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fearnomore"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fwfweflink"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ggbnhb"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghvfg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hendersome"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hthto204"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorboard"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorbt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jfgjg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjgbjh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbrownn4811"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbulljohn"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail1083"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/makee4"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/marhfx"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/millie5566"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newaccount12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oqk001?dza=21456"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/redirtoken981?dop=991154801"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sbccglob"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secubtscjotj"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=btsecurelink"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/submisin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/supportleee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/updategmxmail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifyyourprotonmailemail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmaioptus"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxxx5"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahooatt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200052110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxmytauaipuatatryalp"; http_uri; nocase; content:"linkup.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200052111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/certificates/schlesingergroup/noo-reply/"; http_uri; nocase; content:"lisarobertson.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d-3hbjpx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d2cagqdm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d_kqpmtx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/db5fhxav"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfxw4_sm=ojdszb15xdzzzv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhaqi_sy"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di6hueus"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di_qntwp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/difsmpfx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dkng9_k3"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dn3ujtph"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dnnpnd4y"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dr4agxum"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drgcsgzw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drsgmgjm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drxkr5pj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dvmqs3eb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dxnhhybc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2dq2z7h"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2p8spez"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2stmj2s?=mtqeaywlyj1co3"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3fd6aks"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3g9qxhs"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e55ej5xx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e5gzdpqa"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e5kpq2fp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e_idwusk"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacne62b"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/earmae2d%22"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/easrgdqg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ecymrzgu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/edvvp6ax"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ee5yc9ca"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eefrfkzq?=ojiouwexpg8h5s"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/effdee-j"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/egbbkcqr"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/egtmhpmv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ehk85dzy"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emmrycxb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqe_7fzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqexis8b?=779auzfcptp61w"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/er86brtc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esh6x-2g"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esjzqf_8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/et-dkcdj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eu3tad-d"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eu9zpb6z"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/euhr7uki"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ev55_yea"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evbzscwd"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evdj-yqh"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evjgv5bv?=eme9jh5wippejx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ew4xnymr"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewfyckzm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ews7fgtw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/exc7h6tz"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ez2wd7tg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ezct3vyh?gzqrvu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ezztetjp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g45cgcft"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g4qytsvf"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g6y3fhkt"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gat_yr4c"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gbs4ecw8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gczqssnv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gepk78hu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gezjhddn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gfbpb8pc"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=asrrne8hwgbpmp9"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=jjbpe2kkugganzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=yh2qhzgzcwjq4ri"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghqhm_2d"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gjgskbfu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gkdcpu2w"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gm3fgtxt?=nxfyjvy10exdkuo"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gm9mx7ii"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gmhtpmas"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnpurze8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/grqsxcxg?id=732115"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/grxqxr5n"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gtqqwvzn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gvc3hmpq"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gw2x_btv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gxsukn_z?=hmawyn6k"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gyrmxhc4"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gysdniaz"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200052200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/?code=1a468e385b9475ae1d0bfa645841a01f"; http_uri; nocase; content:"login-live.com-s02.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dqrxai"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jal0cm"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jnrv8a"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/malfqj"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qz2ci3"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zzmtdp"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/claimskinn"; http_uri; nocase; content:"lynk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vvheitv--ubkhdq--wactwuq/oqrrv--jyhha--bzqavaiqzu/index.html"; http_uri; nocase; content:"lyricalart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stimulusbenefit9090"; http_uri; nocase; content:"m.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fcannacoin.xyz/wp-includes/images/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fmoviefreedownloads.xyz/wp/wp-admin/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2foasysfactory.com/wp-content/upgrade/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2foasysfactory.com/wp-includes/css/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2foasysfactory.com/wp-includes/widgets/apijancok.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fahadconsultancy.com/wp-content/themes/api.php"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fbodycare.co.za/wp-admin/js/api.php"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fbridgecr.net/wp-content/uploads/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fcricsports.buzz/wp-content/plugins/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fegyptvespa.com/images/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fevhservices.co.uk/wp/wp-includes/images/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fshop.blacklabelmattress.com/wp-content/upgrade/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fzangava.com/wp-content/uploads/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://qrs.ly/9gdxb1c"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"magyarpoosta.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login"; http_uri; nocase; content:"maile02.oranga.far-facturea.appsuite.metabusinessanalyst.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=1"; http_uri; nocase; content:"maillingoffer.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tr/t/s922tlfl8pw4oug/3/https://w3s.link/ipfs/bafybeigw5jlwvykqqwfwiz7bykja2imjyes2ouyl57dd33vpydeip4efgy/30093a.shtml"; http_uri; nocase; content:"mailstat.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200052228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/import.html"; http_uri; nocase; content:"maintechsnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp/wp-includes/blocks/.2/n1.html"; http_uri; nocase; content:"mandatorydeal.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200052230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/8ud1usio"; http_uri; nocase; content:"manylink.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lnk.asp"; http_uri; nocase; content:"mb102.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/certificate-checker?login=false&amp\;originalurl=https%3a%2f%2fbit.ly.mcas.ms%2f3oynzgj%3fmcastsid%3d20893&amp\;mcascsrf=93b468fdf3284ff3f2c8f22a8a87cba95517d378569921d184b2090fc8102d80"; http_uri; nocase; content:"mcas-proxyweb.mcas.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200052233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/certificate-checker?login=false&amp\;originalurl=https%3a%2f%2fbit.ly.mcas.ms%2f3tbqbin%3fmcastsid%3d20893&amp\;mcascsrf=0f95c59a30af1e3a152874bd1ed8389e360301a106dd1613f05a98f6033f0361"; http_uri; nocase; content:"mcas-proxyweb.mcas.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200052234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/z/6d6d0863709eb4d12e42d0470294282457ae24fa0185021301550162e8d9b2579e505218cdb927e8ed8edcaaa6ad4f0c0185021301550162b494abd9fe919bcc17864e0fa47bcec1f628d78a0185021301550162a3c9d86f47b9100f3cd03832976bfb9d0f862a800185021301550162/verify?l3ovnmq2zda4njm3mdllyjrkmtjlndjkmdq3mdi5ndi4mjq1n2flmjrmytaxoduwmjezmde1ntaxnjjlogq5yji1nzllnta1mje4y2rioti3zthlzdhlzgnhywe2ywq0zjbjmde4ntaymtmwmtu1mde2mmi0otrhymq5zmu5mtliy2mxnzg2nguwzme0n2jjzwmxzjyyogq3ogewmtg1mdixmzaxntuwmtyyytnjowq4nmy0n2i5mtawzjnjzdazodmyotc2ymziowqwzjg2mme4mdaxoduwmjezmde1ntaxnjivaw5kzxg=stf7vvik-gyjv-bvfw-j8ph-1fu7q80j2hcd_dni4zmkdtmavjpq5vfof68rycr0xhsnhos9qaxewtkyw3pzlggmfyipv87zwuasejehjcm4pdvr96xrnxqtohglqzn0gdioykwabmtb3npejfhxymdirdgrcvifzbqa4zv5ewhyswca9jsotukl21u&data=patricia.mayou@nypro.com"; http_uri; nocase; content:"meatmeet.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/z/eca45f405ee97ee8c0f66ab8a7969124019d94c00800255010019623e8f273510e2dd7b9af9738cccc0e5ee0956c8e080025501001963eafee1f53cfe079dbf362d85a28311a1cb10caa0800255010019698c577d7fa14a74d1926bbd767816c6d917fb33d08002550100196/verify?l3ovzwnhndvmnda1zwu5n2vlogmwzjy2ywi4ytc5njkxmjqwmtlkotrjmda4mdayntuwmtawmtk2mjnlogyynzm1mtblmmrkn2i5ywy5nzm4y2njyzblnwvlmdk1nmm4zta4mdayntuwmtawmtk2m2vhzmvlmwy1m2nmzta3owrizjm2mmq4nweyodmxmwexy2ixmgnhyta4mdayntuwmtawmtk2othjntc3zddmyte0ytc0zde5mjziymq3njc4mtzjnmq5mtdmyjmzzda4mdayntuwmtawmtk2l2luzgv4zbd82fge-lzex-8saz-6qrj-djuqne0hrbcp_vpik3abpy0xhmk9fjlnfnrc2jdurlw57btcyhtzsm86ogugxiomyiwrbu7xdw6uvrm8focsctq5zo1ajklvnnpgxbheftqzh3a0ljlvnfbqm3diwb7vetpj0gks6socyazktrwxuideqa9mhzugfo2&data=bgrasso@fultonmortgagecompany.com"; http_uri; nocase; content:"meatmeet.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php"; http_uri; nocase; content:"mi.jetblue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-mail/webmail/rouncube/reo/nza/"; http_uri; nocase; content:"mindbloomcounseling.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=1"; http_uri; nocase; content:"mkcolombiatry.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/references/ask-an-experts/electricity-company-salary-scale/"; http_uri; nocase; content:"mosoah.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/netfilxwebsupportteamsubscriptionpayments/account/login.php"; http_uri; nocase; content:"motraco.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bigpay1/winshopee"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/609890b8001f18095ac075fc"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/60deff002ca34f5aa4985ab3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6112452ca3f6e60d511bad0d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61e2d74ad42da26ef87a2c10"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61e82b96ed8dd6152815c487#"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61fbd0ed6ab665110baf7c8d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6216d491976b950bb612ee29"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6217e24f976b950bb6148afa"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622ef84817a64c6cae942da3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622f257117a64c6cae9476f7"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62528753e911ef58a52499d4"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/628e2c9dbd94a175bb6fe784"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6291f287bd94a175bb75e94d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629b6312bd94a175bb849970"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629c42c3bd94a175bb859032"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629e7974bd94a175bb89ffeb"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a096d7bd94a175bb8dc8ec"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a44bd3bd94a175bb93ccfe"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62aab8d4bd94a175bb9d8b2d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ab0092bd94a175bb9df796"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ac8b3b40535c37d67c13bd"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b21abebd94a175bba7ec1b"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b729dcbd94a175bbb0a072"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62baae34bd94a175bbb57e50"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62bafb7fbd94a175bbb5e6e7"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62cbdb01971e3e097d357811"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62dbab88971e3e097d4f6e0f"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/630e0e70c2748c14c10ef710"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jenetwood/untitled-form-1"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/layananpihakfacebook/resmipemblokiranfacebook"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rayzmania1/capitecbankdebitcheckmandate"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tntexpressonline/forme-sans-titre-2-1"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verificationpaypal/acceptezvosfonds-1"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200052275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/epy7xq3y-office-365"; http_uri; nocase; content:"my.visme.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjaocseooeb.myjaocseeseb.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseaecoeb.caaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseaecoeb.caaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseeocb.caa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjcaseob.c.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaesecroab.ccoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceasareaoecb.cao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaseroab.cco.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjceaseroab.cco.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacaseeob.oa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacaseeob.oa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacasoesb.na.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceasceeob.oaaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsaceascoesb.naaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesecob.oaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesocsb.naa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacesocsb.naa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjsacseob.o.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaeecob.oao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaeecob.oao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacarsaoecsb.nao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsreaobc.oo.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsreaobc.oo.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsroasbc.no.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseacsroasbc.no.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaeecob.oaoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaoecsb.naoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecacrsaoecsb.naoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscreaobc.ooaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscreaobc.ooaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscroasbc.noaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"myjseaecscroasbc.noaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9fr4p"; http_uri; nocase; content:"n9.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200052309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/b/5j9l4"; http_uri; nocase; content:"n9.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200052310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2hhwdm"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6kxp6p"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxnuzx"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k4jcff"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l4khtv"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pogdut"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q3euu4"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qzadbp"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tutp27"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vimyln"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vwzsnu"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7"; http_uri; nocase; content:"netorg6600800-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eml"; http_uri; nocase; content:"netvision-it.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eml/"; http_uri; nocase; content:"netvision-it.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wrelsfargoo/login.php?cmd=login_submit&id=b4e2f37d3cd20c28b43601fc1d9f82aeb4e2f37d3cd20c28b43601fc1d9f82ae&session=b4e2f37d3cd20c28b43601fc1d9f82aeb4e2f37d3cd20c28b43601fc1d9f82ae"; http_uri; nocase; content:"nhatngusakura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/images/data/redred.html"; http_uri; nocase; content:"nihadtrading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uae-post.com.ae/new%20dhl/torsion/index.php"; http_uri; nocase; content:"nuriero.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/2347839829490docs49330/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/25363723wetransfer374833/o/login.microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/255362676428online98893/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/26367738384838sharepoint88983939/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/2646738483949file493030/o/login.microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/266463848doc4783939/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/27747384933st458833/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/3456634455fy45678/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/36467383949sharedoc/o/microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/3668284882934voiceplay/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/367489493903puz35647389302/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/36949499439st565738/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/3884578384wetf844/o/login.microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/46637882949sl47839/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/887897899sharefile/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/899394892933/o/login.microsoftonline.com"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/920220915-16128299872/o/hggstsgjhjh.html"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/frdtal0a81zt/b/bucket-20220614-1751/o/microsoftonline.htm"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/iddgtgli4may/b/bucket-20221004-1639/o/indexs%20(8).html"; http_uri; nocase; content:"objectstorage.us-ashburn-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/idmizrcgumev/b/bucket-20221010-1931/o/mercy.html"; http_uri; nocase; content:"objectstorage.us-ashburn-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/ax0ebl9zgnnw/b/bucket-20220926-1413/o/0index.html"; http_uri; nocase; content:"objectstorage.us-phoenix-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/axjrhj9hpobl/b/ionosauth/o/gsahdhbjdhkoiejejdjdeslkjesjkddkjdcdlkjdjkdcjkjcodikkdjjdkdkddjkjdjkldjkdsindex.html#abuse@1and1.com"; http_uri; nocase; content:"objectstorage.us-phoenix-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"oiazeiuiazolme.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1663678320865003"; http_uri; nocase; content:"olx-pol-kxlsw2.fanhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1663678320865003"; http_uri; nocase; content:"olx-pol-kxlsw2.yashou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=936f66742226eaf0&resid=936f66742226eaf0%21105&authkey=aitnwnmvuumu2oo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view.aspx?resid=cd71337cfb2b3ba9!1313&amp\;ithint=onenote&amp\;wdo=2&amp\;authkey=!ajwhinbbsa8ui98"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a7zxb1g"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hydh4kr"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wm2dp2c"; http_uri; nocase; content:"onl.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"online-helpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e"; http_uri; nocase; content:"online.visual-paradigm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ions/index.php?email=redacted@abuse.ionos.com"; http_uri; nocase; content:"onlinecasinospark.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"onlinehelpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7d646e8c5/login"; http_uri; nocase; content:"onlinesupport.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200052362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1682449218/156e09d0ea8e294db3474e54a2df1dc9/download.htm"; http_uri; nocase; content:"padlet-uploads.storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ripleychile/formulario/formulario_opt_out/opt_out?spmailingid=46529866&amp\;spuserid=mtm1mjmzntkxntc5mqs2&amp\;spjobid=mjiwmti5njg1mqs2&amp\;spreportid=mjiwmti5njg1mqs2"; http_uri; nocase; content:"pages03.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#"; http_uri; nocase; content:"pandude-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"paozeia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"paypal-inc-userupdatenuber7925570844.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sharepoint/sharepoint-3d7/"; http_uri; nocase; content:"pegc.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200052368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orn.html"; http_uri; nocase; content:"perspectivart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.documents/check-info/adobe%20signed/adobe/"; http_uri; nocase; content:"pflexport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/includes/api-irs.html"; http_uri; nocase; content:"pichaapp.africa"; content:"Host"; http_header; classtype:attempted-recon; sid:200052371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page10/page12/dhl/source/index.php?email=shj@calt.co.kr"; http_uri; nocase; content:"pjlanguagelearningassistance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/juegos-ninos/habilidad"; http_uri; nocase; content:"pocoyo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/patior/media/index.html"; http_uri; nocase; content:"powerprecinct.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200052374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fia8mx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fva4wx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvakzx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvllvx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d0uv8808qzu0hxnpoqtl"; http_uri; nocase; content:"preferences.convertkit-mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cpsess3669307974/horde/imp/dynamic.php?page=mailbox#"; http_uri; nocase; content:"premium57.web-hosting.com:2096"; content:"Host"; http_header; classtype:attempted-recon; sid:200052380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=1"; http_uri; nocase; content:"proceedencryptions.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emailfwd/show.php?usernum=350311855&amp\;formid=3879"; http_uri; nocase; content:"pub5.bravenet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2rc41txe"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/actueel03"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aiucxnug"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcfuja3v/?ht"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bcfuja3v/?https://www.google.com/"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdyt5org/"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewqwwwsl"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hi1opzhz"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/if87o5bc"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/in1b4ru"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lt6yhiy7"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ofcclfoq"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r6wxsyai"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stwj0uvm"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ucfuitds"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwxh38rr"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wt7bjibp"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ytmc2hww"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yvqvuzxe"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zv8d_zyc"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hixeto"; http_uri; nocase; content:"qr.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cirpz"; http_uri; nocase; content:"qr.paps.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200052404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bczdkg?userid=ad1e2wno"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bd5q48"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdfevh"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdfngf"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mce5m16"; http_uri; nocase; content:"qrs.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dir/secure/"; http_uri; nocase; content:"qualityscrubset.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jeh2aebbsh97"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qv7malu8n7cz/you-have-some-messages-pending"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatcsrnocn.rakaseeoaseroour.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekoatnocn.rakaseeoour.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotncsron.rakaseoouasero.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raekotnon.rakaseoou.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rakasaeoocu.raekoetnonr.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faxeddoc/"; http_uri; nocase; content:"ranktherestaurant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakcsrorcou.rakoeasaserouern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raoseakcsrorcou.rakoeasaserouern.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raosekocsrrou.rakoasuenasero.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekoacsrtcnocn.rakaseaseroeeeooaur.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotcsrncon.rakaseooaseroueea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotncon.rakaseooueea.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasekotncon.rakaseooueea.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasaecoocu.raekoeteenoanr.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskasecsrocou.raekotnoaseroneea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"raskaseocou.raekotnoneea.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseacsrkcorcou.rakoeaseroaeesuaern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasoseakcorcou.rakoeaeesuaern.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"rasosekocrou.rakoasueeena.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciez7o"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jpasqz"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mub3pm"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prtdrh"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xulqc7"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200052437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba5ge"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200052438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dwi5d?/pages/services/2022"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200052439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrrmq"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200052440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mw80e?./help-accountcenter-service.gtempurl"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200052441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pztsj?./accountcenter-service"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200052442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/medical?pc_url=https://health.usnews.com/doctors/li-lei-1012630&securl=ghy1rdnmwlqytqu2rfrhtf27kllqk76w&type=wap&wap_url=https://mail.ionos.com/"; http_uri; nocase; content:"readmodel.m.sogou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reamaam.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pe/comparador-creditos-hipotecarios"; http_uri; nocase; content:"rebajatuscuentas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0e5950"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/12jqnle"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1b39f1"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1zlck4g"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3btjd15"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53tkcz8"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/68rtlr2"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/84r21ic"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n5p0gwa"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o1lz8r3/?email=registrar@nameshield.net"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o48so8y"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s1k7l9n"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s7jsnz4"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/toy819d"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wvtvgud"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home.php"; http_uri; nocase; content:"rectifywebwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"redatofadesafe.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/111/"; http_uri; nocase; content:"reflexologyegypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reikreitel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fiv.htm"; http_uri; nocase; content:"renataassad.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200052465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/77a4fcc0"; http_uri; nocase; content:"replug.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200052466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mailservice?url=https://ci4.googleuser=%20conte%20nt.com/proxy/qrclxpwgysi1rf2vddyxuf1xk3fdjdd--avtzkbfsw-51gwhfk2qjkj2=%20qpw%203yxkyvveihj_m4yd1wfepj1jyj-fr9ltz3pgqwlzo9hgjtntqw3tmxaujonfw0iyt-a=s0-=%20d-e%201-ft&proxy=yes&key=c7d1173f601f75093c848d58166fbed4"; http_uri; nocase; content:"resize.yandex.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e9zk5"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g2emzn?coinbase?shiny"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nomxvl"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xeknoz?confirmation"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xgmxr1"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200052472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2d0jazx1eky5/click-here-to-verify-your-email"; http_uri; nocase; content:"rezunz.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nats.sern/5/rnnp.php"; http_uri; nocase; content:"rgcgov.edu.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200052474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"riderctposten.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/ea8a/redirect.php?id=7c18c315d71119489192f48f2b84ad73"; http_uri; nocase; content:"robinettearchitect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/126151794/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/169158604/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/276334374/profile/"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/366175746/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/460877431/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/587560897/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/590868924/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/597298789/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/624797638/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/631349272/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/662161167/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/668240736/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/673236557/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/users/736099514/profile"; http_uri; nocase; content:"roblox.com.kz"; content:"Host"; http_header; classtype:attempted-recon; sid:200052490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/84nd0q"; http_uri; nocase; content:"rotf.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200052491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o0910p"; http_uri; nocase; content:"rotf.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200052492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c8vn"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1hwks"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1k9a5"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accedibper_info"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accessoportalebancabper"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b_p_e_r_web"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bancamps"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bnl-verifica"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gestionebper"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gruppobpersicurezza"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/infobper"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login-bnl"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login-clienti"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezza-bancamontepaschi"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezza-bancamps"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezzaverificamps"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/validieren"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifica_bper"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifica_bper_web"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200052511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ndltqxfz"; http_uri; nocase; content:"s.pointerpro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/~pixlge1/home/?utm_medium=social&utm_source=heylink.me"; http_uri; nocase; content:"s23.proserv.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200052513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662071543984x382403125991823940/index.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662567373229x779238078226475000/fx.html#x@x.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1662614585247x113432212858644020/0987654323405o6789065uytr5678iuyt.html#a@b.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1663018729985x498369598269489540/shared_document.html#a@b.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1664350305554x121358905509268750/indexnew%20%281%29.html#journal.adiktologie@lfl.cuni.cz"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1664388801167x576854715603624100/mrkautoindex.html#info@google.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1664889222607x998204730112145000/3m1cr0s0ft.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1664925528340x709738662644046300/indexcp.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1665389895720x959084139761374700/elite-aym-dbs.html#user@domain.tld"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hellochef.kitchen.asrhundemobsfljdsasnmlslsdgnasmkg5/1aweghsafgs.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/labfield-webapp.aesrdhtjfdghsgafsdhjdtgjndfnsdbsfhjdgnfs68/7sdfhjgdjd.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/progressivebank-uat/index.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/safiepace/refn26.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/theretaisdkjgndsfajkxbnakmsdnfaskmsgslfmgaawf18/2awegsega.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail-ionos-system/restore-mail/delivery/ionos.html"; http_uri; nocase; content:"s3.ap-northeast-1.wasabisys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/theclinkrestaurant.com/index.html"; http_uri; nocase; content:"s3.eu-west-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https://lnkd.in/dtkemh_k/1/01000181edee1365-4264f7b0-9ab1-433f-bde7-5a51e550f60f-000000/ieg4om1atju-oqjrjgeit3bwfzm=277"; http_uri; nocase; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https://lnkd.in/dxnhhybc/1/01000181eecab6cf-769da54d-7b69-4125-84f0-dc49abe930cd-000000/t_-tkxz7q3rbxjaufqrdl3ugqcy=277"; http_uri; nocase; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l0/https://lnkd.in/gczqssnv/1/01000181ef97b996-9967a6f4-660c-4b15-8e7b-e4d82fc18c31-000000/wreobv0u8fyjq2kivbylo-hy2wa=277"; http_uri; nocase; content:"s4r9mj97.r.us-east-1.awstrack.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200052532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaeeeiescssceoe.saaccacerseoorria.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaaieesecsesoe.saccacseoeriaor.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieesacseoe.saccsecoiaarser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaeieescsceoe.sacacsceorira.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiceesecsesoe.sascacseoeraior.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaieeecescssceoe.saacsacerseoorrai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaaiseecseoe.saccseoicar.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaeaiescssceoe.saacaceseoorcriaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaiasecsesoe.saccaseoeicaoras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaicseecseoe.sascseoacir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceesacseoe.sascsecoaiarser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieceescsceoe.sasacsceorari.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaieseecasoe.sacseoiacserr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaaisceesoe.sacseoicr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceescaivcsearirincr.soreaacsieosnaiciaoeaosonseosir.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivcceaririccrsoorna.seieascaacirsoocaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceessaivceeaririccrsoorna.seieascasciooocneaosesonssiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcceaririecrcsoroan.sieesaaacircoesioaoeaosenseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceiseaivcseaririecrcsoroan.sieesaaccioeosoaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivcceaririccrsoorna.seieascaacirsoeoaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacaceissaivceeaririccrsoorna.seieascascioeooneaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciesseaociniaoesesonseosen.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririocrn.orsaeaciessoacciniaoesesonseosen.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaaciroonieaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacacesseaivcceaririscronor.aseaiecssaocionoaoosesonseoren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccecaicsairncr.soreaacsieosnaiciaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiccairccrsoorna.seieascaacirsoocinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairccrsoorna.seieascasciooocnaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccesaiceairscronor.aseaiecseascioconaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaiccairecrcsoroan.sieesaaacircoesinioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccieaicsairecrcsoroan.sieesaaccioeosoinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiccairccrsoorna.seieascaacirsoeoinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccisaiceairccrsoorna.seieascascioeoonaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciesseaociniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairocrn.orsaeaciessoacciniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaacirooniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaccseaiccairscronor.aseaiecssaocionoaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saacsecsesoe.sascasceoeai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaecescssceoe.saasacesceoorr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiascsceoe.sacacseocriaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaeiescssceoe.saacacesceoorr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaicasecsesoe.sascaseoeacioras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaieacescssceoe.saasaceseoorcraias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saaisacseoe.saccsecoiaas.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacseoe.sascsecoaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saicsacsien.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiecascsceoe.sasacseocraias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200052751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"saiscasoe.sacsceoias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"sasaeiicecseecrson.iseaiorcseoeosninveri.ipcvku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/macros/s/akfycbxldfmsdlmc1xmyfvmhpijk0qxsnxurlh95jzz3qcvmodhollh-cgwk3ql47_ntzyajzw/exec"; http_uri; nocase; content:"script.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"sdzakfahz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceeesacceirccrsoorna.seieascaacirsoocinaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceieeaccsirecrcsoroan.sieesaaacircoesinioaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesacceirccrsoorna.seieascaacirsoeoinaoeosnmer.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceiesaceeirccrsoorna.seieascascioeoonaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacesccaecrirsoona.seeascacrsoaocaoeosnmer.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seaceseeacccirscronor.aseaiecssaacirooniaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacieccaserircsooan.seesaacrcoaesniaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacisceaecrirsoona.seeascscoeoaaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seacseccasorirn.osaeacesseocnaoeosnmer.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascececsaocnrir.soearacseosniaoeoosnmerrnesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseccaeccrirsoonar.seeascacrsooaocaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaccsrirono.arseaecsescocooaoeosrnmenresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasceseceaeccrirsoonar.seeascscooooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieeccascerircsooarn.seesaacrcooaesniraoenosnemesrc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascieecsaecerircsooarn.seesaccoeooasoaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseccaeccrirsoonar.seeascacrsooaeoaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seasciseceaeccrirsoonar.seeascscoeooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaccsrirono.arseaecssacroooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccaecsrirono.arseaecssoconaooeosnrmernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacesseocnaooeosnmrernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"seascseeccascorirn.osareacessoccnaooeosnmrernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200052804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/postenno_9.html"; http_uri; nocase; content:"seonewsservic.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bwmo2dey0oeybq6yopel62/%26%21%29%24%290%3e%21%24/%26%29%21%24%260.w%24%24.html#info@mup.cz"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nwanespi862tnvsyahi017hx8/!$9)!&amp\;$!)0/!$)nsh!&amp\;$)).html"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sungmai7d6gsbni8179w9dkal7357/&!$)(&!$!$))!)0/&!$)&!$())(!.html#redacted@abuse.ionos.com"; http_uri; nocase; content:"sfo3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.php"; http_uri; nocase; content:"sfr-support-client.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/__macosx/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%2"; http_uri; nocase; content:"sg-stamps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/__macosx/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%20account_files/sign%20in%20to%20your%2"; http_uri; nocase; content:"sg-stamps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/jean-claude-fernandes_sgdb91_com/exk2a_c6xsxouopoew83oxib65oghw_co2bz33les1rdxw"; http_uri; nocase; content:"sgdb91700-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0nlined0cufile0365/indexx.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j7trucking467/3sndftr.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1nf2c-aodrjqdzggr2mg9xaevrta"; http_uri; nocase; content:"share-eu1.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11c1i3ucrsjaeqnyxinop6ad5rxo"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1onniqroftvoytwpvbgznvgd5749"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1q6hj0hs8qeiyr1t5ntqimgd8cyx"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1whluifnasr6s4ov9skogswd5n96"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1zwug5hvmsuik9mhaflsx3gd9wnt"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d"; http_uri; nocase; content:"shared-document.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/product/h5zibdt"; http_uri; nocase; content:"shoppy.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200052823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bkmz1?ixqgr"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200052824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtvx"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200052825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fiknr"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200052826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nqgu1"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200052827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ful6dt"; http_uri; nocase; content:"shrtco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200052828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aac-qeyjzvidp4a0udxwmx8posfwalxooywveihug66gdq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/babvqblsz1lcnztguatcjnjcbey3scofu-iptechmfyipw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/caaqd92_nje__i8_di9jswqyysy6hgxxguuujza0qxtz2w/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/caccwingwl1ucrtyuohvlf8x9wtawho4wow8_hogisxrrq/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cadgaaxmhb7khuhj9pqz5rjrpjvblumqwifacimbglzara/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dac9nzulzomdp2j34hlrgttw3etvkkhofdrqts1tfdxxaw#example@domain.com"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eabibfvu2cs824kdijdrs-n_zwu-ye4drkasdgdocktsta"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadegp8olvx30uebqoj3bpsgpy3uxb-f8hcwq2hu9rioha#contact@sceneworld.org"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadgwcmx-4fdipry_ojhza8y0un4hsn_mvcoaghml8l00a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fabi3nifmvbemdr3vfnnartz-odinrt6mbhlscx8lu4uda?548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351bvv548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351bvv548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351b548f417f-3f21-11ed-959c-4a6c380351bv548f417f-3f21-11ed-959c-4a6c380351b"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fabmjfbda7cmfwdxg7n16qntvuwpae-neagxvowf4e412a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faeart8txt-4221ph3o_zrgghgmpnmekqibmyo9bd82i4w"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fafvln-jqvmrdq7qdhmxlxzbbbpukxyjqiqbm3czhuuuuq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fakjhyaxtduuvxg_-v_uyjupuv4hrs-e26tghs4dirphmw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gabj9dg2v84fgqwivbmkwiilcffy-1-gb8twtwkvcfacda"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jaacvyrihh3qeybhzw84gjwo6rs1bltm4rylkk9ogb84mg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jabvpgnogmkcs_wzdf7qs4ivd73hiwxbm424oyc-da10gq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jacrivm91b9pm4njxkfeipfsjhbxdvk84p8q0-sma2kntw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mabqkzupqxwj3vxyi-glmhekpwtfmiprz9l-crv4yci1fq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/madstdjqg5mhwpfhxl39kfctx_8ufmlyh-s_uncfmm-ohg#contact@sceneworld.org"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pal-9jprh79gg30kow2xqyifnwh-z9lrxbfnfer9y46lwg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/racpadmrydirxxw8c1fe-qxgpfgkbax2xcadtyupqfpl-q"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaakijl6dd8kbre_hwfkcafdasebbut6js-ggyer7fzfrq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaayqhcjskxbeu4bvfljtto23b9x5xoeaqfnj9td7f_94g"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vacjfe3dmwbochzm44cfibdxbqsq_7lzcodsu-p4gmi9yq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaco-rdh0nkfpzbingpml9wyrohfza-tjsnvkzma1repyg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zab42krc6gwyzed9fly3ztawq2kcos2dgspptomfmj9plg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zadojqbo8pmrdimdobyodbjgh-gc1xtot4x2_kxcddchpa#benton.cantey@diamondbackindustries.com"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zadr3i18zrqpiemqvyzwwl30gquwkqemhvph-nvarff84w"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200052857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/publish/xhrdvc"; http_uri; nocase; content:"simp.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200052858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#/?code=58858608"; http_uri; nocase; content:"sinkeffect.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200052859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a/sy4norton.com/setup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amricalturs.net/download4/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amricalturs.net/ks3/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/crypto-coinwallet.com/exodus-wallet/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamaskchrromeextension/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamasklogin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n12-netempresarial.com/empresa-nerd-n12/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/orange-mobiles/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/e9d24c72/23524457"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/habbotuttogratis/assignments"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/protectedinmprovmnt44/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/safetycheck427064200647221/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/verifycheckpointpaqes/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/traconf-it.com/flashyfile/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/019businessusersbt782btsignin/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/02amr/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/04-am/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/08ie-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/09securebusinessusersonly-/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0iey-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0range-bank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/108-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/12noreplybtuserconnect365offic/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/1mailxverificatio/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/2-orangebank-salva/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3-orangebank-vetch/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/302dir/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3254798fr78/uigiugi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/4-orangebank-toto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/443edxsjkl8/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/565f34/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65h7t65ygtdw5f4/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65q-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/7wr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/91186co/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/98w72securebusinessbt-01/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/a3y-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abonnevocalweb/accueil?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abuse-privacy/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-aud-msg-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-docc-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-docxpdf-call-net/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-salesorder/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-voice-mail-pay-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-office-ml/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-p-o-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-po-pay-m-cd-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accsoffice-usa/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/activationagrisecuriplus/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/adrianoferriani/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/alert-app-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amldk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amporangefr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amsohappy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/app-mobile-uuid/recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-obank-serv/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-scur-obankps/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/applkactu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-authentification-forte-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-mbl2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-obank-apli/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/aqwsas"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/asdfghjklhgfdsdfgh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/assdffee"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/assdfr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimento-online-emissao/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimentomarnobre/p%c3%a1gina-inicial"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-mail-update/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-managements/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-net-/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemailfox7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemler7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attfeatures/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attlattlattlatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmailcustomerupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmaillogservise/attmail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attndattndatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnet-104921/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsignmail/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsservce/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attonline00/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attserv111cust/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attttstttegegrsksw/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attudnie/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attupdateobo/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweblysiteupgrade/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahoomail7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahooohroffice231/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authen-secure-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-apps-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-orangebank-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentifications-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/awspage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/azssdf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/b6ljxyar/information-page-report"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/background-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bacopremolista/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/baltimoreassessoria"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bambe/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/banquepostalebanqueetassurance/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbroadband110/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbtbroadband/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bcp-mille/home-page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bctw/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bdbbbb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/benachrichtigung-sparkasse/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bienvenue-carrefour-banque-ass/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/biorange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bletoemisao/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/broadbandplc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-2022-user/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-users/secure-business-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btaert/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbillreview/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbraodbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandlin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc1/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandteam/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandweb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbtbtbtbtbtcomm/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbusinessx/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200052999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcenteradmncare/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudvoice-mv0001/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectbusiness/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectmailserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectsecurebusinesbtcom/bt-connect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcustomerservice/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btee0/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btemailwebmailer/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btintern/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternet42day/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternetco/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmailerupdatee/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btserver10/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btservicebill/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btsuporteamsup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbusinesssss/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecom/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm-/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm0/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommication/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommservice/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommunication-plc/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btuiytretyudfgjh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebmailww/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebsuppor/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btweeb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworkingteam/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworkking/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworldwide/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businesbtnewbroadband-hub/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuse%20r=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businessbtxpress/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/buxtonbreweryofficial/official"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/capitaloneloginus/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ccjkc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/certiauthavril/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cgnvzmx/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamfare/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/charlisto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cirrusunversiteparissaclay/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clickpagenewlogin2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cltytytyt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clxyxsnh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/comfimobiekdofl/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-pages-app/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-relief-program/crf-dispatch-illustration"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-relief-program/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/condado-duo-luis-pagan-/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmation-orangabank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces/verify-pages"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectionperdue/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectolo/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectsvqq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/control-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/controlpanel-ovh?/48700315fr640w648"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/couldie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ctz03"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/currentlyserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cvrpd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/d-aps-orge-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dambt/home?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilolwas/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilosadde/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dasbvmk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dbs-com-g/privacy-policy"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/debloquagedescompte/page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhckuyf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhl/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dgjhjjojhgffg/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dhddfhdfhcom/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/directionmessageriemonespace/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/directionobweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dispo-obankweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/divsec20/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkdfkazii-ofoqisjaz1wk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkekkeole/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/doelza/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dshrkuoiuhgkjkjlkmjyhhfhj/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eaglemaddez/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eikp-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/emreszra/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eruiizetyo/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/erydkjsdkhfgjfhjdkh/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/es-pace-clien-ts/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-clien-ts00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-de/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-orange-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocal-orange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espaceclient-orange03html5/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espaceclientscuritvfvfdsvsf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espacemessagerieorangesms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/estomcasting/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/exodus-wallet-shared-rewards"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fa-ctu-re-es-pace00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fabienlaracico004/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fabiodhouman"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fac-tur-ation010/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fac-tura-tion-esp-ace05/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/factu-re-clients/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fantasticpage-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatct-ure-es-pace01/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatherplac/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fattiu776/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatu-ration-esp01/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fcg133/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feelblessed/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feriousca/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ffduefuefsbc/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fhiefeiih/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/flmkgknzklfgklfgk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/france-banque/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/frdfhhh/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fscdsh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fssghsfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gajiview/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gdhbfcxzx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ggfhftwyjfj/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxmailerfttfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/golppu/page-recovery-2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gsdeaq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/h6wrjhcs6tt9fwphome/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hbxchx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hccwc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfggdfyhcom/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfgggggggggggggg/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-bt-updates/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-pages-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hommem-loggiinnformm/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/httpbtbroadband/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/htvvss/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hvgfdcftfttf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ii-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/incomm-sso"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/inf0ssgss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/infoline439pent0line/accueil/untitled-page/fdsls32?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoice-payment-pdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoicehomepdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ivxep9/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jcnvvn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jdvdksf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jio-tower-installation-apply/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jjjjeeebbbbb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jlkb6rf/apps-support"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jmjmnhvdc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jnbhgv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/juif00012/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kflkllf"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjhydc6yh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjnbhgvcfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/klklklkutu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kmp7w"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/koiuld2dkjcxnjk2s/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/landbankredirect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafadd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafpadrode/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lidl-bg22/bg?fbclid=iwar3vyju-ddafnwfna5hgyotzwb0pjkbcfmwydmyrixienrmngx7gzksmlom"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/line01-centre/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkdiur24/accueil/secureli20"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkoeir3190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/llllogin-home-pageaa1/www-btconnect-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/log-inpagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/loltym/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/magazineluiza22/promo%c3%a7%c3%b5es"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailcustomerservices/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailtoh/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailyahooservicesverifynow/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallhitoh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallofuaq/halaman-muka"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/manager3-controlpanel-ovh"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxatserv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxmaner/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mcwdbvefjberjrwgnwriviwr/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange-gms-mms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messageriehtlmxccvsdfvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messor/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mldof"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mmanuel/attyahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mndirilivin-online/verifikasi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mnoko"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-apps-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-redirect-system"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/monbonusclicetmoi/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mssft22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mv-voicepage/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/myatt-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/myattworldconnection90/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mycoinwallet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/name29/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/necrologieinfosfroravocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nefsuddma/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/new-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newbtmissedcall/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newuploadpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newvoicemail/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/njsdghjdqhdkhqk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notice-pagesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeplaypagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticepublicpagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeservice2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notifcationnoticesystempage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nouveau-sms-message-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-certifier/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-identifweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-seccurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securites/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-verifie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob2clieconnec/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob4direconec/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-authentificat-forte/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-securit/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obespaceweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-com-mail/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-srv-cnt-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/offiice-voice-com/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/olarico--fact05/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-0"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlineemail890/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlinefifthercheckaccout/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/or-pro-mobiles-et-forfaits/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/oracoservclie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangbnk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-b-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-espace-client1/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-facture1/admin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb-190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb171/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb221/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeba/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeban/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-22/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-r/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-sc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-secure-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebanksecurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebannk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/fact458"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangehtmlcofirmationqcdsvcdvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeibank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeinfosvocalnews/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemyconnect/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeportailretun/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesecurishtmlvnc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangevocalwebmaildigital/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/oranggebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangiebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ormas/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/p2j/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/p2k3oqt/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/p85nrn/recovery-page-support"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pagenewlogin2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paissnsns/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-press/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-securit-societe-generale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-vo-tre-fa-cture/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-customer-services/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-loginn/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pkm6w/recovery-page-support"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleasecheckpoint2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclickplaypagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclicktopage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/portailscurit-orange/accueil?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/portailscuritorange/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/postacerticodplusaccaccueil/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/preferences-coordonnees?bredbanquepopulaire.fr/authentification/transactionnel"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/private-bt-policy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/projectupdatepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/protonmailservice/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pstbrand"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pushfarcot/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickmailer/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickteamservice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/r64t9/security-page-recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/recatss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirect-acctpages-uuid/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectme-to/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectmybank/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionglobaleactivate/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphfrancecentrerelations/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/register-reward/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regl-ement-fac-tu-re/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ret4e/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/review00zzz01/bt-home-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/reviewappspagerviicee/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/richcoff/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rimekahsdjg/summary_page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rnorangefisrt/12547op"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rvcefte/recovery-suport"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sadcfasdc?facebook-security/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/salimkaso/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/saudipost-spl"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbc-106616/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalm/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalmaillerrrr/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalnetbellsouth/att-yahoo-mail-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/scbwebmail/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sdbdbdbdbd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seccure-business/secure-business-bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/section-ob-web/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-bt-homevoice01010120/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securebtusers/businessbt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securenoticepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securiplus0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-app-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securitee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securites-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securree/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securritee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seecurebusiness-/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-ob-fr-2022/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-obank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-espace/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-authentification/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serveur-communication-box/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servi-orangbank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-apps-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-securi/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servicenewlogin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seuysihofficebtbusinessbrir/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sgdfgetf/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sharepointofbandhan/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/shgeudh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sign-in-eml-com/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitatt/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitgandii/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ski03/strona-g%c5%82%c3%b3wna"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/soeyankandi5/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/szdgsdhgd"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/szoquwz"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/taffac1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tergelinca"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/terlenaaja"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/texaschildneurology/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tg5oltrd0/information-page-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/thenewstartpage2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/theservvvvvvv11ajw2/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/titat6867gghm00/%d8%a7%d9%84%d8%b5%d9%81%d8%ad%d8%a9-%d8%a7%d9%84%d8%b1%d8%a6%d9%8a%d8%b3%d9%8a%d8%a9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tl8ba2l/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tq4rdkn8/security-page-info"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/trade-skins-csgo/cs-money-trading-bot-for"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/trade-skins-csgo/cs-money-trading-bot-for?gclid=cjwkcajw4jwzbhapeiwatjun0dl_fgxbxvn3xtp0a2awuttz4ieqicpiuzcaltoy8hpg0i8gjnz78hocqzuqavd_bwe"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/trewyyuuu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tsaftez1/information-page-recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tyryrtrtrtyyt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uiora"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ukhdggdfgd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uooh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/update-allreadypage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatingnewpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/upgrade-bt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaconnectingcom/att-yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaoush/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utereue/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utututttu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uuhqv/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uujejuz/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uyt6rf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uzl2kop/?faacebook.com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/v-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/venmo-loginusa/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verfy14567/opensea-nfts"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verif-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobi-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobile-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-orangeb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificati-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verifmail03/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfbjf/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfdffktt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vghgn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewespaceclient-orange03dml/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyournewbill/bt-business-btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyourrbilll/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vjsdhdfidjasi/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vkjjjerljjarea/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/voipnotevocale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre04/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre12/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votreone/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/wallet-near/near-wallet?gclid=eaiaiqobchmilkxyoryq-givjmltch3fmqwleaayaiaaegkahfd_bwe"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/walletliveconnect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/watchingregard/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/wazxbnm/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webespaceclient-ref8/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt23/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailnotification093/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weebmail123/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weelcomsign/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/wrttt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ws0l"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/www-signin--com-cancel-reset/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/www-voice-en/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/x6e1fn/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xcccjcdhasks/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xmicrosoftoficew/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xvhfefef/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xxbmicrosoft/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah000/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah00mall/home/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoo-mail-verify/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahooend/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahookwhjf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoolip/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailactivation"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailconfirmination/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailingdesk/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoonice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ydkyf/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ymchitkweed08"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/zkb-online-3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ztt5zazu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sanjin/client/index.html"; http_uri; nocase; content:"snndc.co.jp.yeypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sanjin/index.html"; http_uri; nocase; content:"snndc.co.jp.yeypt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/info.html"; http_uri; nocase; content:"solucionesachgt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"soufritont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yc9un6ssxe"; http_uri; nocase; content:"sparka-kunden-ort.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/60oghgwcy4"; http_uri; nocase; content:"sparka-kundenkredit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stt-c4968a"; http_uri; nocase; content:"sprw.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200053467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hwpahwpa9hwpa7"; http_uri; nocase; content:"st.fanlink.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200053468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?gclid=eaiaiqobchmi94bpzz-j-givg9kych0yigapeaayasaaegiwu_d_bwe"; http_uri; nocase; content:"star-atla-experienc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9"; http_uri; nocase; content:"steinercoza-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com"; http_uri; nocase; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200053471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/guide/en/pdf-online-access-813co6iagv/steps/1844666"; http_uri; nocase; content:"stonly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/kelmanco.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/acc03lzzl4m3izm03iauserpowa.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anaagc040gdyacgd0dyuser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/clientid4dunptjlryzrift3nrlomi160gqntzgznajujcnbszq8w/index.htm"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmc111/cdo-nwst1.html#helpdesk@widomaker.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmc111/chaidon.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gu1r0utjruhjkukrxhauser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https3a2f2fofficeuser2fowa2fresourceopenidmsdclientid727c9d/index.html?authuser=0"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/oscman2.html#cert@soc.tdc.dk"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/pdflmanco.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/pdflmanco.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/zdewaman.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lllumin/kcautoindex.html#pa-ed@gtig.qa"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/index.html#martin.manasek@ruk.cuni.cz"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logonservices8g7gs65gs9bs66vds7bd9nd/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lttna/zkele1.html#acctbilling@widomaker.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lttna/zoscman414.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/aliexpressautoindex.html#dan@danaxtell.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/index.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myautoindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myofficeindex.html#@yorku.ca"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myowngeneral.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newkaraindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newmineindex.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/webappindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/projerroro0h5j5ro0jrrj.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qaqonqfaqvq0fni33q0x.appspot.com/index.html????dddd"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qaqonqfaqvq0fni33q0x.appspot.com/index.html???v"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/riltool/mrkautoindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rrdar99rt9qraraq99euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s0pts0apttxpp00atarrauth.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/solttitll098/upgrade/thenewgenautoindex.html#susanjohnson02020@yahoo.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;rip=1&amp\;nojavascript=1&amp\;ifkv=au9nccwgqgxybveyj_rmt1ijh5qqlfd7xhs9ssn0ocwja5n3jm1gnfvdcuhslngz3y67_oax8ufr&amp\;followup=https://storage.cloud.google.com/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;service=cds"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/nvhdjgtpl8txagtoccpyscuekxctc7j3kpg5bbugwqv0kemeas313lqehufuifcl6el9vtvomhrfbjbpxbg6qrnsg5sz3dyaiqor%2c%2520ffx6khej2lavfftroaizcq99hjdn3f4hs6gdeg2qodfyhobl8zonx6lez2dafyafc6spylufytfvuzn1jsioh4u6xpsbsqxqgh.html#icann@tecnocratica.net"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/sydlasgendomain.html#winnie@soupro.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tilittjkilot/kakaaautoindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja.html#william@nabaza.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja2.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/udunwa.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/user517497679326978.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1234_off/767566757676.htm"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1234_off/767566757676.htm#accounts@centrica.com"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1827435283/1827435283.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html#alfredo@tecnocratica.net"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210726_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210910_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13669_md/1/788/1401/22/1025434"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13695_md/1/788/1401/109/376564"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13664_md/1/455/1401/112/814109"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13695_md/1/788/1401/25/339407"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/29040_md/1/4631/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32440_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32621_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29237_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29627_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kekvmftbijqr/qarqoiskwcbx.html#ezacvbnkpm?cbbbbcccs2ptcxvckcdcc5csc3pjpckzfcbbbbc"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newuserlpo/index.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/onlineupdate/vendors/to2.htm"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pemotion/tixrin.html#/ytk3zstywfhgqtrevnj2amjnsuj2y01athbtukdvaxvdl2faem9wk0c5befnwerjm3rgqnbnzuxqwxk5c3hvuexjd1zud0twm0r0wk4xukltzutwdwvrakx1zwfdbfm5eeirwvgzdjlovg89"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/reaganstarkyjs/fqh9haa.html#tizioebsr.6x4ivkd4em5v9fgqt?f1tdqwcc4vybcxfhvcdcnvcyc45jphdc7cbbb4p"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/srvrs-quarantine-update.appspot.com/index.html?email="; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#cl/19939_md/1/4441/3808/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#un/19995_md/1/4542/3682/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teampass/ha231120/hrf2zsdf/newb.html#2243022fe5715752yo615523864ez9739qk24hnr139714jz"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uvyzcsiggb.appspot.com/pduqg.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wjscsfikph.appspot.com/twava.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200053559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession19/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession20/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession21/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html#corinne@zilch.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession23/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession24/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02416b2d-e521-48e0-9d61-d6495062cb37-bucket/steps5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02828cfa-e421-4462-9568-7a45f46fa5fe-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/02e32dae-2d4c-432f-bab5-e95d0db36172-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0347a193-3509-4f84-9eb8-8c7aa3c40ba3-bucket/5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0347a193-3509-4f84-9eb8-8c7aa3c40ba3-bucket/7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05ca6e42-0651-4c81-8d99-25a5a15f73cc-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05d07142-ed07-4096-9a5a-22b46343a8d2-bucket/continue.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05f20de3-6d8c-4ad0-b831-6e19bed67032-bucket/mailchecking1/ljhfzzjkvptkjbhwjfvfhvcwmjmqnvzctkjwqntmdjnjzjltvxbdwxgpfnnhtqgvhskzhr(1).html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05f20de3-6d8c-4ad0-b831-6e19bed67032-bucket/mailchecking2/ljhfzzjkvptkjbhwjfvfhvcwmjmqnvzctkjwqntmdjnjzjltvxbdwxgpfnnhtqgvhskzhr(1).html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05f20de3-6d8c-4ad0-b831-6e19bed67032-bucket/mailchecking2/ljhfzzjkvptkjbhwjfvfhvcwmjmqnvzctkjwqntmdjnjzjltvxbdwxgpfnnhtqgvhskzhr(1).html#security-team@ionos.co.uk"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05f20de3-6d8c-4ad0-b831-6e19bed67032-bucket/mailchecking3/ljhfzzjkvptkjbhwjfvfhvcwmjmqnvzctkjwqntmdjnjzjltvxbdwxgpfnnhtqgvhskzhr(1).html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/05f20de3-6d8c-4ad0-b831-6e19bed67032-bucket/mailchecking5/ljhfzzjkvptkjbhwjfvfhvcwmjmqnvzctkjwqntmdjnjzjltvxbdwxgpfnnhtqgvhskzhr(1).html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/073f0681-64f1-4f27-9986-a7cbcb285e97-bucket/servermail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/07c4251a-c257-4926-b3c2-0ed73624b5e3-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/085b9b78-0ab2-44d7-9e89-f616947a8290-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/087b6283-aa2e-4ff2-bcaa-e9e7e922b694-bucket/meet1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/087b6283-aa2e-4ff2-bcaa-e9e7e922b694-bucket/meet2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/087b6283-aa2e-4ff2-bcaa-e9e7e922b694-bucket/meet3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/087b6283-aa2e-4ff2-bcaa-e9e7e922b694-bucket/meet4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/087b6283-aa2e-4ff2-bcaa-e9e7e922b694-bucket/meet5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0891749f-909e-4267-9438-457e22431647-bucket/grace5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09380f13-ffb4-4157-af2d-193b1a8c105e-bucket/regime/voicenotice.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/096593ac-2eca-4a4f-80f0-5daab89ec1f3-bucket/proj.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a075dc0-d303-41ce-ab00-570639b6782d-bucket/pwjdhudjmq0psmn/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a075dc0-d303-41ce-ab00-570639b6782d-bucket/voip-telec0munidsgxe/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a39a5ba-dba3-4fb5-bff3-5e73de94c728-bucket/12xxvcv/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/0a39a5ba-dba3-4fb5-bff3-5e73de94c728/uxb.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a39a5ba-dba3-4fb5-bff3-5e73de94c728-bucket/fredbox/taramfred/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0a86fac1-63ac-4139-b8ca-3038c914e256-bucket/worker3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0b4126b5-bbd3-4b45-b0ae-f1b78fe697e0-bucket/index%20(2).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0c0a62dc-4401-49af-bfa1-511cf49cffd4-bucket/linkeen.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0c9132ec-9643-4af4-8c51-078fb5efab0f-bucket/invc0201.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0dc3c1d9-f66a-4170-9960-69facae4c688-bucket/qen.html#x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0ff4cc32-f859-4a44-a78c-0e9d7980824f-bucket/webmail.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/12876e87-eb0f-4f82-bde2-8ee0148e9312-bucket/lis/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1344327c-237e-4837-b03c-0a2821ccb49d-bucket/2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14a2f715-cb61-421c-a1c7-966bcb291f16-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14e8eb22-d4a9-4105-85d8-08261460a270-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1547eea2-6309-4177-9176-edeb6351a5b4-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/157b22eb-1a90-4cc5-8a28-037169f89b29-bucket/ob/loginss.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/15a4d60d-9bfd-40ad-8b5f-d3bd7a38d88a-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/170e9994-ea3e-4dfa-a388-34c3af1ab2d5-bucket/hon/irs.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17294928-d2c0-4733-95fb-9edc39870f4d-bucket/keepnow.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1730ad2e-b5ea-4199-9ef5-016339155306-bucket/indexl.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17841cbb-7f9a-40ad-a1aa-1667c7c1d5ba-bucket/mailingserdomain5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/18611b3f-086f-4e39-87ce-5a1676786a71-bucket/qen.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/18e74947-7f50-450e-b0f6-c66aad00fe1f-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/18f11056-0746-4859-a59b-65e7cb150f5a-bucket/mails.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1a8fd766-4d5e-461e-8bfc-c728f7651d00-bucket/zamule/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1ad8dec7-46ca-4414-aad2-d40b9d393bd6-bucket/dd9/index.html#tanaka@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c20489e-d757-45a8-83ed-6231dbca099b-bucket/in2foodaustralia%20document%20folder/scanned%20storage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c4f5365-9747-4b0e-90bb-23f5e391849c-bucket/365slink.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c61e284-5354-48a5-b13a-be7c8f3b7105-bucket/mailingserdomain7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c8da883-9442-41fa-941c-80be6481d56f-bucket/bulet3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1d912b44-1c41-4688-8a21-b749fbb550e7-bucket/way.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1e42a772-d186-441f-868e-81f2fde0cf03-bucket/gadget.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1f77225e-c7fa-4a80-a1ea-980f98f449f4-bucket/6fuggibc/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1f77225e-c7fa-4a80-a1ea-980f98f449f4-bucket/7gtdt/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1fe526bb-5b83-4613-8376-b6e16c8c0a2f-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/217da67a-5c83-4fa7-a077-287e4b9b7e8f-bucket/terry1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/217da67a-5c83-4fa7-a077-287e4b9b7e8f-bucket/terry2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2200d9f4-37d0-416c-83fa-4eabd473372a-bucket/mainx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22533933-4ba9-40b8-bf76-a822fb2028cc-bucket/one/view%20doc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/22b5ad07-22d8-4137-a753-eed64883b182-bucket/overlay5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23118b7c-bd8c-466c-8a0f-5a9338658e84-bucket/cssdn/mattt.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23a45a7b-21d5-43e1-8dcd-acf81abec49e-bucket/papybuggy/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/25ff62e4-9663-470f-8515-17155ab4cc57-bucket/store2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/279b9836-1e2a-45b4-8fe2-48ef945ca842-bucket/noseit/skechtix.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28a32247-c609-49d2-8aa0-3169aaf59b2e-bucket/server%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28b92292-b3a3-4fc5-8f8e-0126dba82ee9-bucket/ggenn.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28f41801-e232-4bff-9f9c-bf888ca41377-bucket/verificationmailcheck10/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28f41801-e232-4bff-9f9c-bf888ca41377-bucket/verificationmailcheck7/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28f41801-e232-4bff-9f9c-bf888ca41377-bucket/verificationmailcheck8/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a6314f1-1972-414d-b15b-6789e36e84c4-bucket/scrippt.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a6e3314-6fd6-41b9-a503-737d8990a69b-bucket/newnortonauto.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2b3d723e-95dc-438e-9cc8-454e67de81c4-bucket/cod/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2bb4f76d-c658-4807-a30c-be62ae3f3c0a-bucket/apple.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2be46cf3-38c7-4fe4-8523-6f8d0ea7934a-bucket/files-folder.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2bf98903-09b4-4d51-b55a-f457c12b2c19-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2de8538b-36c1-4a81-962b-efd465fad6e6-bucket/access/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van1/index.html#phishing@irs.gov"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ec9db52-41a4-4bb3-b073-3a67d64aab20-bucket/van9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2f263c65-37df-4fe4-82cf-bde27d774632-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2f2e988a-b3c7-40d5-ac83-088b1bef53c3-bucket/a/cos.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/30f6af46-aa9d-4de3-9f15-765ead389e86-bucket/webmail.htm#x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31b115c1-311c-4275-99b7-7904d022ad7e-bucket/navyfederalcreditunion03.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3347ec1f-277f-47eb-b286-cfb21b70479f-bucket/office365.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/33608ce8-d809-4ea5-9e8d-a68b14ae61ce-bucket/ms365.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34ba28df-6627-4ad1-bd1c-40bda3dec365-bucket/linkedln1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34e2727e-cc91-4458-a41b-7bfba9c737aa-bucket/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3669c475-283c-4578-9196-9aea39a11aa4-bucket/01/puf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/36faf61a-ec14-4175-8810-c1c4aff18763-bucket/bcse2356/test1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/374fa52f-c4ea-47a9-b19b-c7f92d591c9a-bucket/unisco1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3881952d-6ae0-4f5a-abc7-c38c7b0c1cb2-bucket/dropboxddddropbox/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3a6ea15a-585f-4859-a754-100e256992d1-bucket/bc/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3a6ea15a-585f-4859-a754-100e256992d1-bucket/jhy/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3a6ea15a-585f-4859-a754-100e256992d1-bucket/kol/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3abf5106-57a7-45c9-a8fc-13baa44e803e-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ad30708-8b27-4f22-b0ca-4cdcaf01ae7c-bucket/pdf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3c2fb691-0695-4cda-944d-5eecde7f7920-bucket/office/login.html?xbvjs=52mqxjrcnwkeiwqtqz6jp9fig9jd&auraczgfn=tckeliingkpvga68bvortri7bgaa&iwaj=hwumqe4jsamfuip2&elfezzvx=o4obbise3dszrcv3uu5bwj&olusrxzp=ftdr21iuexihsd2mtx8dpjdllg47o&fxnx=ub4ggebbisrmwvu64pdnozq2okqoy"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d20107d-a0ab-454d-b952-f0cc43872720-bucket/servermailing9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/22/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/33/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/88i/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/frgtrytu/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/gfd/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/hgf/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3d50c757-8d4d-4aee-b372-3d113175e220-bucket/oiu/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ef86e56-084c-4753-9df8-d96e286c0e9d-bucket/pradit3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ef86e56-084c-4753-9df8-d96e286c0e9d-bucket/pradit5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3f9b2dd1-e15a-40e9-ae2b-15bf8d627037-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/40bed425-0d9e-4c62-bb8f-9c413d2d7aa8-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/41800835-442e-4753-85b2-a15887bb85c3-bucket/draes1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/41800835-442e-4753-85b2-a15887bb85c3-bucket/draes2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/423661de-373b-4dfb-8fed-8ec3b3388623-bucket/uye/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/42a4267a-0383-4b52-89b9-58ba05708e50-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/43a922bf-1a85-4351-a0c0-362dd42bee31-bucket/lank.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/43b897b1-a1b4-4c47-910a-9373f5551f6f-bucket/sharepoint/onlinefileshare.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/43f69713-d821-4c25-8363-673b90aee7dd-bucket/32323/testowa.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/44104130-81a0-4eb5-bb14-ed974f61fb47-bucket/myoff.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/459518fb-8d2b-4356-912a-b57525b246c6-bucket/odere.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/459518fb-8d2b-4356-912a-b57525b246c6-bucket/odere.html?email=#jomama@fbi.gov"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/45f08fe8-ef6b-4fd2-8495-507532e9e013-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/464b9ea8-ef3b-4f35-ba0b-afe898e62d45-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/48df6d15-56d8-4977-81fd-0236f264a5eb-bucket/a-ionos/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/48df6d15-56d8-4977-81fd-0236f264a5eb-bucket/t-ionos/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49afd6b0-06f1-4f83-88e2-76ac3ff68da4-bucket/servermailing1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49afd6b0-06f1-4f83-88e2-76ac3ff68da4-bucket/servermailing5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4aa2534d-51fa-4b73-b4a9-5ff77f790ebd-bucket/draging5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4ce09e3d-fef7-420d-8e23-31b2b402bebc-bucket/3rfcdefred.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4d291858-3983-4e4f-b98b-c1bde34b0e60-bucket/pw/index.html.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4d291858-3983-4e4f-b98b-c1bde34b0e60-bucket/pw/index.html.html#abuse@ethz.ch"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4d291858-3983-4e4f-b98b-c1bde34b0e60-bucket/pw/index.html.html#none@example.org"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4dbe0f33-2cbd-4814-98c7-2ab7a391be60-bucket/bou/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4df9f8c6-4f96-4ae5-a9bb-82e51d2a9d9f-bucket/offer_rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4e0b865b-6391-42e2-9a64-5efbdc5bc386-bucket/verificationmailcheck38/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4e0b865b-6391-42e2-9a64-5efbdc5bc386-bucket/verificationmailcheck39/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4e0b865b-6391-42e2-9a64-5efbdc5bc386-bucket/verificationmailcheck40/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4e0b865b-6391-42e2-9a64-5efbdc5bc386-bucket/verificationmailcheck41/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4f0b4552-765c-4a08-bfc8-b22bbc1073ec-bucket/seach2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4f41c94f-3e02-4423-81f5-93af46730a1f-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/509bd11e-a920-4c3a-8248-47b9666e6043-bucket/pcm-ingenierigeld0c/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/52663812-784b-4e1a-b4a0-2b64fbab4850-bucket/new.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/52a20491-52b3-4341-bbd8-cc274a4b1eee-bucket/box.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/52d36baa-e745-4841-92e3-f34e9c9df49c-bucket/ihjihi/login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver6/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/53205beb-e9f1-4cdc-88ad-5732e17b1dd0-bucket/emailserver8/index4.html#username@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54145e60-be61-44bf-a465-5be604c5fc57-bucket/officestorage/login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54829f8c-054e-42e6-b159-6511046746e0-bucket/fileofc%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54f2e839-d862-480d-9c0f-f130c0fc7d01-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck13/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck14/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck15/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck16/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck17/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/551adfdd-e603-42af-92aa-10b9ea17b71f-bucket/verificationmailcheck18/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/56261e77-9ba3-49fb-9f57-11c14aea3fde-bucket/renwe.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/56833382-ae0c-4d1d-9614-4307406d1067-bucket/download%20pdf%20attachment.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57b68e2f-bb84-4026-9d12-c3fc1b90f9b6-bucket/&!$0-.&!$!$$)jar.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57c85b2d-e340-46c0-9419-4228856c624d-bucket/ofdd.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58a29414-dac1-4f44-b09d-a6b351e56199-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58a9d810-4566-4174-910a-8274c0ca5156-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58d4908c-793b-4b7c-a88c-8f1c7d7d5523-bucket/vrfpage/vrfportal.html#orders@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/58d9cb92-a511-4227-836b-a45fefcd7b6c-bucket/clippas.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/594ae299-05ea-4930-b9e5-c5342625ca4a-bucket/11777/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/59baaf79-b41b-409d-ba7c-f4acaeaa8a24-bucket/domainmailserver2/index2.html#x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5a2c07e1-381b-42aa-883c-bbd297be8b21-bucket/hoank1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5c962aa3-4ac8-4845-b47f-3e535df71e7c-bucket/boot1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5c962aa3-4ac8-4845-b47f-3e535df71e7c-bucket/boot2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5c962aa3-4ac8-4845-b47f-3e535df71e7c-bucket/boot3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5c962aa3-4ac8-4845-b47f-3e535df71e7c-bucket/boot4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5c962aa3-4ac8-4845-b47f-3e535df71e7c-bucket/boot5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5cb163da-f1bb-4c1b-a8e9-14695e01f82e-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5da1f541-2b7c-45f5-bb8f-7608db26980d-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5daf191e-7f85-42a6-aedd-51080bc0fa56-bucket/io.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5dccdcb9-a76a-423b-8109-b4923299ea78-bucket/talbrt/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/60262110-3cae-4646-ade9-887cd5639d84-bucket/yz/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/61480a35-422f-4cc7-b58c-f487bc6c5b65-bucket/securesecure/hfjjfkvkd.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/61480a35-422f-4cc7-b58c-f487bc6c5b65-bucket/uwmdhdf.shtm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/61deb6d7-0f39-4b5c-be7d-b3d5c7279b8b-bucket/cssps/securedf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/626f2e42-3345-42ef-b584-0e1d1f19bbaf-bucket/cards/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/62ac7c12-f24c-43d1-b3a1-581162f4c42e-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6382ea8e-bed0-4a80-8167-117c945bde45-bucket/pa/newpage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/63c007fd-0d4f-4d49-a221-34f978ef5fb7-bucket/x/x.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/63e3d9b6-39e8-44f5-8f71-bd9064380a09-bucket/tf/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/648d03ef-0b94-494f-824d-f1c768eeb80b-bucket/file/portal-1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/648d03ef-0b94-494f-824d-f1c768eeb80b-bucket/xxa/portal-1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/651c5d2b-159c-4e3c-8558-c24132b84178-bucket/papillon/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/65dbb473-51c0-4bcf-9a87-99b7110c0818-bucket/gmx-login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/66096d55-0650-4645-b1f6-d85fb3e0ad75-bucket/dddd.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/66096d55-0650-4645-b1f6-d85fb3e0ad75-bucket/dee.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/68630c1b-8de9-4c37-9b02-a399843fb05f-bucket/favour/index.html#user@domain.tld"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/687356ea-9d2d-40ca-b3ab-3130f967beab-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6875f8bf-7782-4d15-89b9-f1ca1f41bbb1-bucket/a/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6875f8bf-7782-4d15-89b9-f1ca1f41bbb1-bucket/f/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6875f8bf-7782-4d15-89b9-f1ca1f41bbb1-bucket/h/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6875f8bf-7782-4d15-89b9-f1ca1f41bbb1-bucket/hl/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6875f8bf-7782-4d15-89b9-f1ca1f41bbb1-bucket/l/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6acb3647-1d42-46c9-ab36-0ae7631e5389-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6ad717a5-dc3a-4833-9e6d-ed6c50cd9aa3-bucket/04/olori.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b1e919f-20bf-4f29-8357-6f39e7d5f17f-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck25/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck26/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck27/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck28/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck29/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6b597d75-db6f-4b16-a4f9-2f0f45f1b9c4-bucket/verificationmailcheck30/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6d94d7e9-c9e6-4b03-bae7-37770cf86467-bucket/verificationmailcheck55/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6d94d7e9-c9e6-4b03-bae7-37770cf86467-bucket/verificationmailcheck56/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6d94d7e9-c9e6-4b03-bae7-37770cf86467-bucket/verificationmailcheck57/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6d94d7e9-c9e6-4b03-bae7-37770cf86467-bucket/verificationmailcheck58/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e5e33c3-e5ec-4c45-96f1-d939967fc193-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e63baa8-8023-45f9-a747-0aadfc5f7575-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e7e5395-69fc-4f7e-905b-c8cb66cef347-bucket/secure.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e7e5395-69fc-4f7e-905b-c8cb66cef347-bucket/secure.html#irena.jindrichovska@mup.cz"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6fb54de1-0ac2-4845-b632-3431d9f3bc49-bucket/updatedomain13/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6fb54de1-0ac2-4845-b632-3431d9f3bc49-bucket/updatedomain14/index4.html#user@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7056a6c7-dbeb-40c0-ac79-0dbf3718b1be-bucket/yhuyt.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70b1299a-8d76-4da1-82fb-4d1cf8ed10c6-bucket/wiko-file/encrypted%20file.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/713c525c-169b-4acf-9f92-772bd4aa425b-bucket/unite2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/713c525c-169b-4acf-9f92-772bd4aa425b-bucket/unite5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/73764aa4-36f4-451c-ac26-d45e25726a8b-bucket/creditstatement/newindexphpg.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/756463f1-d70c-497e-a6e5-8dff84152d1b-bucket/sharedfilecreativeprocessunderprojectaliasconcretefacilityunderscore/pdfff.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/76531d31-6c0d-4779-8593-132667a81515-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/766e2246-0cb2-4006-a3ac-b025b19e324c-bucket/4iivoio.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/766e2246-0cb2-4006-a3ac-b025b19e324c-bucket/helloshellss.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/766e2246-0cb2-4006-a3ac-b025b19e324c-bucket/napped2321.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775b360c-eb23-4eb4-8661-3f596d2c0b85-bucket/verificationmailcheck32/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775b360c-eb23-4eb4-8661-3f596d2c0b85-bucket/verificationmailcheck33/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775b360c-eb23-4eb4-8661-3f596d2c0b85-bucket/verificationmailcheck34/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/775b360c-eb23-4eb4-8661-3f596d2c0b85-bucket/verificationmailcheck36/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7810f4f8-2a81-468f-9279-549518cb2827-bucket/hg/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7810f4f8-2a81-468f-9279-549518cb2827-bucket/mand/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7946c409-3403-4c75-8d5a-42dcd45f22d2-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/270920221/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/270920222/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/index1/industries.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/79e0eebf-9221-4180-806b-e1dcfdb099fd-bucket/link1309/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7a74bbc2-d6c4-4023-b0e1-07f015dc3e06-bucket/authtryencd.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7c7c6b45-8c85-4051-b99d-c4fe2f126d52-bucket/sweet1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7c7c6b45-8c85-4051-b99d-c4fe2f126d52-bucket/sweet5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7d6c458e-1944-45ea-82ec-d2858466a75d-bucket/verificationmailcheck19/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7d6c458e-1944-45ea-82ec-d2858466a75d-bucket/verificationmailcheck21/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7d6c458e-1944-45ea-82ec-d2858466a75d-bucket/verificationmailcheck22/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7d6c458e-1944-45ea-82ec-d2858466a75d-bucket/verificationmailcheck24/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7dabb6a2-3778-46dc-9570-785069c1263d-bucket/01/french.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7e28c615-a042-44f3-9517-e79d645d8fd4-bucket/young1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7e28c615-a042-44f3-9517-e79d645d8fd4-bucket/young2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7e28c615-a042-44f3-9517-e79d645d8fd4-bucket/young3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7e28c615-a042-44f3-9517-e79d645d8fd4-bucket/young4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7e28c615-a042-44f3-9517-e79d645d8fd4-bucket/young5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html#orders@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fe52344-71e7-491a-957a-0808a3db62c4-bucket/idoj4td57.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8284401b-3d5f-47e4-a934-d5c2e4230410-bucket/play.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/828f799f-ec93-49ee-80de-39133affb3ee-bucket/bcse2356/test1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83c66579-b5b4-4c28-b275-68e2b9322fc4-bucket/file343.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/843ddc8e-7812-425d-8786-ff9f92019e5d-bucket/2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8513abd3-4ee4-48b6-b77d-1bd18a7cd8c9-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/85b40028-93e1-4251-a7ea-f6a82fe39b02-bucket/index2.html?saf=https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=newssearch&cd=&cad=rja&uact=8&ved=2ahukewiz55cxq8_4ahxagvwkhr61chqqxfqbkab6bqilarab&url=https://www.skysports.com/football/news/11095/12641238/manchester-united-are-in-disarray-and-its-the-toughest-job-of-erik-ten-hags-life-says-paul-merson&usg=aovvaw1wp_sdcri1tjtpy1ncedif"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/85d1d389-7917-471e-a98e-6ceb56867031-bucket/morehere.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/86abe507-d43f-48e1-83cc-996b90ef0b1d-bucket/view.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/874423c4-5870-4de7-a59f-232a02efc3d9-bucket/teri/industries.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/881ae0d6-b4ba-412f-9014-43b40841126a-bucket/office.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8825716b-47be-4920-9c9e-1ac2704de473-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a00ec1e-658c-4e29-9ea5-46121ba6e3a0-bucket/office365.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8b451ece-c4a5-48d8-841a-b574505a6de3-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8bdfa202-61d7-4dcc-9a29-d6fe52c23e80-bucket/lankkk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8d0edb70-6f45-418b-8658-01904eed48ae-bucket/founder4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8d0edb70-6f45-418b-8658-01904eed48ae-bucket/founder5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8dc99422-d4c8-42b5-85ba-33ace76b8a2c-bucket/emailserver4/index4.html#username@domainname.net"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8ddcf426-854b-4fcb-bd30-ae418d4442f2-bucket/supportedkenheadken.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8ddcf426-854b-4fcb-bd30-ae418d4442f2-bucket/supportedkenheadken.html#user@example.org"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act12.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act30.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9040ef9a-119e-4ce1-bf63-b09a71ed2f80-bucket/act45.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/905e69ea-0462-427f-a482-2d4a4ad0560a-bucket/varen1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/905e69ea-0462-427f-a482-2d4a4ad0560a-bucket/varen2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/905e69ea-0462-427f-a482-2d4a4ad0560a-bucket/varen3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/905e69ea-0462-427f-a482-2d4a4ad0560a-bucket/varen4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/905e69ea-0462-427f-a482-2d4a4ad0560a-bucket/varen5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/90962a42-132b-4c83-a3a1-92e113f2c3cd-bucket/nddc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/91cee7ae-ad27-45c0-b553-63e08fe3a3e6-bucket/tny/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/91cee7ae-ad27-45c0-b553-63e08fe3a3e6-bucket/tny/test.html#user@domain.tld"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92782670-8e61-4be0-b6f2-17ee79399a1e-bucket/p/index.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/964e1048-5b03-4dec-967c-466e7f3537ed-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/97dc58b3-c8a8-4c6a-8a7a-8dcafe2abf80-bucket/dee.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/98b28e3b-634d-4bdc-a5a9-b7735e2ba109-bucket/authtry.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/99e44e81-9b24-4834-88f5-02b58e83bacf-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9a2dd98e-1817-44a5-a4d0-501dd1898f7f-bucket/indeex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9ab62c49-a453-4eb8-9ee0-722202f88635-bucket/rocky1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9b058b1a-4344-48eb-b6d0-3553bbc51dcf-bucket/indeex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9c208930-8835-454d-b049-7127541e7c21-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck1/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck2/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck3/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck4/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck5/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d5f8c9f-f2d7-4035-9069-7e1c1f0b7b79-bucket/verificationmailcheck6/indexdns.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d6804cf-7315-4198-a3a7-7a92c121e92a-bucket/puritty2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d6804cf-7315-4198-a3a7-7a92c121e92a-bucket/puritty3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9d7d1e58-5930-486a-b39d-31fbb3e857ea-bucket/excel.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9dd5041e-dc3c-43c6-befc-cdc72cf64192-bucket/vaccation/vaccation.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9e67832e-c556-4b83-98a9-93e1463540d7-bucket/link/link/link/link/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9f2d23ca-c5df-409f-8d0b-f2f040dca5cc-bucket/mncbx/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a050c21d-41f1-485d-bf4f-b3d5c9a379f1-bucket/graham1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a050c21d-41f1-485d-bf4f-b3d5c9a379f1-bucket/graham2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a050c21d-41f1-485d-bf4f-b3d5c9a379f1-bucket/graham3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a050c21d-41f1-485d-bf4f-b3d5c9a379f1-bucket/graham4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a050c21d-41f1-485d-bf4f-b3d5c9a379f1-bucket/graham5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a0ce0e96-1821-4a6e-889c-d4b1e43eefc8-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a11b8653-2408-4a21-a39d-5ad8dba1268b-bucket/pointsrdl/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a13b5ba6-f9f7-4203-92e4-c62f329c654e-bucket/isjdomsnbckmkrezsxrdtpokjiuhygtfrdeswzxdswedrfdedrtfgyhujikominbuvyctxr5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain21/index1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain22/index2.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain23/index3.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain24/index4.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain24/index4.html#username@domainname.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1f1764f-8d6c-4472-9af3-cb93bb5ab861-bucket/updatedomain25/index5.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a28af659-48b3-4d12-a22e-b8899d734a75-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3ea993b-e46b-4262-86bb-e203b205619e-bucket/share7.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a400b283-41de-4205-a74f-2b4e0b7555ad-bucket/owa.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a550df2a-219d-4b56-9462-100403b29a5c-bucket/saved.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a99125d3-2062-48d4-b67d-7413aee8aa2f-bucket/d-dropbox/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a9dcb77a-c11d-4d70-99fa-a42461bdc9c2-bucket/fileofcc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aa6a9059-1df0-4bd7-8fb9-bd7e76ea9f61-bucket/htm.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aa8ac295-0826-4310-ada2-ed606a6b8c7b-bucket/blackaaddaffs/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ab0c9e7e-8dca-495f-ad77-1f431e06f58a-bucket/accountset.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ac994d38-e771-44ca-a76e-7c9e5223d6c7-bucket/003888899.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ae1f34c0-f236-4186-a66c-a4347914270f-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ae40b8c3-cbe7-41fd-a6c7-306467a5a693-bucket/customindex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aeb1625f-38ba-4374-ad3a-878dcba7ec19-bucket/columbiacountrypdf/scanned%20storage.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aedb1bc4-8509-4b3f-906d-6bdba0efea4b-bucket/syndic/confidential.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aeefc22b-f6c9-4bdd-89e3-b78f762f51d6-bucket/young1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b07f2a1c-ed65-49c3-9aa9-7e91c3a0529c-bucket/a/a.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b0bd2cbe-f008-4b39-93fa-49574464444f-bucket/tyu/loginss.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b0fa22f7-e13a-4cfa-9a71-f859c22c995d-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b2432d30-bda5-41c3-aa56-f0a878377315-bucket/james2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b2432d30-bda5-41c3-aa56-f0a878377315-bucket/james4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b2432d30-bda5-41c3-aa56-f0a878377315-bucket/james5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b2f2a717-aa3a-4486-b828-5726d95b10bf-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b30e9a6d-e37e-41e8-803b-169531010286-bucket/owa.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b31febab-2b3f-430f-9a24-8daf73e60972-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b32d705d-753a-4868-9067-ca33b43864db-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b4c3fbe7-7eb3-4f11-9cf0-03c4e3fd47e3-bucket/vroot.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b5f2e73e-1327-427a-9481-d013814ef127-bucket/ww.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat1/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat10/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat11/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat11/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat12/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat12/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat13/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat13/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat14/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat14/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat15/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat15/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat3/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat4/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat5/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat6/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat7/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat8/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b620e7da-f4f5-4e6e-8d8e-8c4c3783180b-bucket/vat9/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b71b9137-cd44-48b4-93d0-5223010560ee-bucket/adobe/doc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b8b6d789-eee9-49c9-bb10-b45954338aee-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200053999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b937d62c-b576-430f-b4be-119cfe7a64bb-bucket/s39b60d3ff90c4e781b8.html#test@alam.edu.my"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b974e635-f03c-4000-a3d5-e507d952cc23-bucket/zxcvbqwelz/indewells-1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b99dc5da-abd5-4c9b-8828-dcab1cade273-bucket/thir/login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/indexx%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b99e914f-bb98-4ec1-ab58-b34bc904e356-bucket/server%20(1)%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbb53b82-e723-4336-a344-fe30b5a2f097-bucket/fancy5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bc904cf2-8abe-4e8a-ad5d-8774596d97a0-bucket/inshawesdrctvybuniexscdrfxeszxrctvybuniominubyvtcrxexrctcrxectvytcxrctvyctxresdrftgyuhjik3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bc904cf2-8abe-4e8a-ad5d-8774596d97a0-bucket/inshawesdrctvybuniexscdrfxeszxrctvybuniominubyvtcrxexrctcrxectvytcxrctvyctxresdrftgyuhjik4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bd1d3480-affd-446f-86f9-b0c95c3a215c-bucket/crosby_securities_limited.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/be398e0a-30f4-43b6-90d2-1175acae5ff5-bucket/document.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c10c5f76-f186-4743-a4c6-7ef6fecbe9d8-bucket/fileoffc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c14d401f-b22b-46e6-9e64-b9e6d663f172-bucket/vbnm/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c252a894-34a9-45a0-84b3-9edfe2b5dfaf-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2cb4ebf-e864-40e7-b152-eff2663d3fc3-bucket/blosuom3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c2ff9cd3-0839-4c85-b8d1-fd29cac483fb-bucket/ma1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c4ecb581-c14c-4528-a005-0ca9b227f956-bucket/mailupdate9/index.html#test@test.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c4ecb581-c14c-4528-a005-0ca9b227f956-bucket/mailupdate9/index.html#username@domainname.co.uk"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c671945f-e9be-46c0-99c0-71b004e059f6-bucket/a/cos.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c78b79a1-7ce2-4374-9ca1-b60fef47169b-bucket/920019992.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c7c14c10-4110-48ba-97cb-22b16746a77a-bucket/index.html?email=x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c7cdfa4c-71b9-4ed2-bc0b-d887cb80f0a4-bucket/g2r/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c802419e-3144-40aa-97f4-2f87adc9ef71-bucket/adress1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c802419e-3144-40aa-97f4-2f87adc9ef71-bucket/adress2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c802419e-3144-40aa-97f4-2f87adc9ef71-bucket/adress3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c802419e-3144-40aa-97f4-2f87adc9ef71-bucket/adress4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c802419e-3144-40aa-97f4-2f87adc9ef71-bucket/adress5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c88eafb2-61ee-4e29-950a-7f909ae26ff6-bucket/neture5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ca78995a-cd30-4dc1-861c-2a5b52c37b30-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cbffd7e9-e873-4c72-8f7b-69ce9161e733-bucket/doc/file.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cd2c6635-23ba-49bb-bf73-c6b10d0021b3-bucket/office365-outlook-microsoftoffice-authentication.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cd58cb52-dd4e-4dcc-a2ac-54d4b76d6c9f-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cd67645e-8bb5-408e-baa5-0a38212c8e58-bucket/axis%20mechanical%20inc/secure-pdf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf712e3a-7c7c-41d0-8589-86b9d60318da-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d024ca4e-b6ac-41d7-a224-193b035fc1cf-bucket/ppr/index.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d07abc36-1bdf-4400-820f-9f9679bc8d11-bucket/invoice/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1036811-cb11-47a4-a859-470e4ed5f6fa-bucket/microsoftlogin-data/micrsoftonllline.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d14de9fe-3e43-4fe4-9fed-1b8b2dcb4290-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1ae1249-5ae7-49ae-b4f9-4f16b530e070-bucket/rfq11012.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1dc6e73-7931-42ef-aaa2-1f5d61d4bb0a-bucket/owa/02384972384623453672.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d3926cde-e08f-42c6-80a3-bd9faf31dba8-bucket/ricebeansgames/dr0pf1leupdatesabsnew.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d468dea5-ad1b-4520-86ec-d3dd4c15ed23-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d474ca09-59f9-4e4e-95bb-3853d367cb3c-bucket/none/milkr%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d4cbd57f-a85f-414f-b484-7c3f62d2528d-bucket/keepnow.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d501c5df-659a-491b-9b28-97ef88fdcf56-bucket/rest/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d501c5df-659a-491b-9b28-97ef88fdcf56-bucket/scoffs/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d5ae077b-9a18-4576-a723-be65692aaede-bucket/365/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d6ba5f32-1c9e-44ab-bfa6-27a100306508-bucket/msh/shrm.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d6ba5f32-1c9e-44ab-bfa6-27a100306508-bucket/shrm/shrm.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d90b174d-7b66-4112-96db-71c06b38e453-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/db523aa0-3715-4c11-9c2a-666adfe438e9-bucket/indexx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbbba225-63e2-46ea-8637-c3a8a7bff992-bucket/jeff.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dc13decc-2169-43e3-81f1-e1c465fec279-bucket/singer4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dccbc06a-7bb3-4120-bedc-27d94b5a6e43-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dd0e20ce-63b8-4df1-9e80-a2e4bf9b89bf-bucket/hi5/test1%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dd0fbd66-95b6-47a9-9648-0df7c81ffc5f-bucket/redx.html#elektra@debeij.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de106e12-afc7-47ed-a45e-172440798261-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/decca190-a63b-4b0e-9ab0-afb6c79bae04-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/decca190-a63b-4b0e-9ab0-afb6c79bae04-bucket/update%20/webalizer2.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfd4aea1-217c-4ca8-8e98-e7bd93ce5d2d-bucket/sdre/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e0671c39-2dd6-4672-872f-78792d0f2a30-bucket/cnmus/tim.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e09f3ef1-7bac-486e-99b2-12dd553973f8-bucket/00/langs.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e24fd81c-fe35-4220-916a-5f6bdbbbd78c-bucket/authh.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e262d47d-ffb2-405f-8aa3-59034a23b618-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3f21bd5-7ed2-4b34-8327-735a0b83032e-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e444812e-1b00-48ee-aa43-bedef06e3e66-bucket/onedrive.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e61eeede-3cd0-4c0c-a107-08833c0ec841-bucket/swclassics776372.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e6c0e686-987e-4853-9894-bdf380d6c872-bucket/greend2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e727fdb1-f41c-4a9b-9aea-d2f78c56a401-bucket/adobeverifystoragebucketapisystemauthorinitiative/indexxadobe.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e775e9e9-7b55-40c8-a6a0-fc0adb899459-bucket/fileofc%20(1).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea0eec92-d57d-441e-90e1-a455ac4ae949-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea9d06d3-f885-4946-a633-dc68587a74d8-bucket/902113222.html#redacted@abuse.ionos.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaec3e2b-c02d-4192-b10c-b8c8a9318a1f-bucket/02/index(6).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eb56343d-c3ff-4a12-9707-7b1e7b7df558-bucket/webmail-login.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebfd41a2-fd8b-4507-8e55-8cef921acd7b-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ec16a01a-a84f-42da-bb4e-43675e3533bb-bucket/docu/drop.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ed482e2c-83aa-4482-aabe-ad7bd0ef20e5-bucket/cre.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ed81890a-3d9e-44a6-a354-325ad6d2478a-bucket/newf.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/edd36ae3-3254-4149-83ce-17be188be9e0-bucket/wenutritioncom4/index.html#user@example.org"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eed55a84-55f2-499f-a1bb-6e1bf7cfb87c-bucket/03/milk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ef692558-db56-4b63-89e6-ebb8162f59f2-bucket/approver5/approver-email.html#xx@xx.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efc10aba-c569-426e-b4a9-cdaccd2a84f4-bucket/se787tw578w/indestri.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f0c651e7-d81f-43e3-ae4a-a71fa39a1a37-bucket/eeeeee/index.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f1e747e4-2191-4882-bc0f-5f96e3778913-bucket/configresolve3/index.html#info@mup.cz"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f496da6c-c2c4-4ab0-89b1-f9f90ba6d617-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f6025d56-bf8c-4d6b-9d21-319f7b4fbca5-bucket/rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f62883a3-f731-456a-af6b-2640464a91b7-bucket/index.html#x@x.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f65409f0-fc6e-416e-8256-76487a2c8ead-bucket/pric/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f6754a7a-4690-4893-a319-74b13e6286bb-bucket/super2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f684530c-767e-461c-843e-b59d2a9b9d5c-bucket/fileofc.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f7dd921b-6e7b-4e20-a34c-c787224bf50a-bucket/weboxi/hubgitx.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f878cd6e-6f7a-4fd6-a74f-ff07c9ff12b2-bucket/wills1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f878cd6e-6f7a-4fd6-a74f-ff07c9ff12b2-bucket/wills2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f878cd6e-6f7a-4fd6-a74f-ff07c9ff12b2-bucket/wills3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f878cd6e-6f7a-4fd6-a74f-ff07c9ff12b2-bucket/wills4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f878cd6e-6f7a-4fd6-a74f-ff07c9ff12b2-bucket/wills5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f933c214-70d2-444b-a8c9-7cc3b8fb8a83-bucket/offer_rfq11002092.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec1/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec10/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec11/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec11/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec12/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec12/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec13/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec13/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec14/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec14/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec15/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec15/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec2/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec3/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec4/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec5/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec6/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec7/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec8/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93bbabc-c9fe-416b-9895-abc3c414d6f4-bucket/tec9/index.html#a@b.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f998e9aa-245c-4de3-9708-58d39f2cfdc8-bucket/get/bra-dhl1(1).htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fa7d3aaf-eeb8-4e02-8d10-6c34571a5548-bucket/em-accountshosting2/index4.html#roger.meier@4synergy.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fab72164-712b-493d-881d-6d892416573b-bucket/verify.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fd178da9-a7ff-446a-a1af-a84d061c4988-bucket/nova/msqrl.html#j.jongkind@wahlen-jongkind.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fdbe15cb-8405-4530-937e-33356dca6c19-bucket/02/intell.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fde44815-8fc3-4db1-bf26-86926ffd3985-bucket/styles.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fe9c9046-b062-4bfc-aae7-2d78864bdffd-bucket/frc-18963bc27412.html#abuse@optusnet.com.au"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fed7fce4-adbc-499d-985e-9c3ea4070ada-bucket/ggenn.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/chf/9910d7163a27a4a27/"; http_uri; nocase; content:"styleguide.drapefit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#abuse@optusnet.com.au"; http_uri; nocase; content:"stylishingapps-documents-webapps-6ck5e.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200054158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uns?qok=rb5&ij=zachary.bussey@arheart.com&d1qn=&%20humming=%20healthy%20humming%20birds%20hopping%20at%20a%20very%20mean%20birthday%20party%20wh"; http_uri; nocase; content:"subscriber.hjyl168.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jp"; http_uri; nocase; content:"superhochzeit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit"; http_uri; nocase; content:"superpark-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qbz5jjm9a"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/millennium_management_llc_e1780935.html"; http_uri; nocase; content:"supplierss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"support-chase-help.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbas?bfqkc"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbas?pfznlo"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?jfqcs"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?tnjem"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?wtkpo"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbgr?zkvync"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbih?gqdss"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbjh?jupzn"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbjh?unhiep"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?erxji"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?nngxs"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?sesxxad"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?xfcgxy"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200054177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zs/ffbunc"; http_uri; nocase; content:"survey.zohopublic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/608bca7586919c70a2066ef7"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/60fff0e60888042acd81382f"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/621b14f5c65e8f2fdc0ec20c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622b8c8ed898226fb3ed9404"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6255d8c288a46f5efbbc781c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index/790fda364e7f349debc0f2dbaf241c8f/"; http_uri; nocase; content:"swiss-pakket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index/790fda364e7f349debc0f2dbaf241c8f/seleccione_medio_de_pago.php"; http_uri; nocase; content:"swiss-pakket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.cha.htm?feeccf00ec7600bcf71c"; http_uri; nocase; content:"szsmartest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5wzcfrnmij"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=gvnj958o&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=iu65vdbt&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8kuqorubt4?signature=newsletter&amp\;trackingid=qj0y6ihhlutkjd3fwk0gxurjedhgfoe1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9ooxxstzmb?amp=1?trackingid=aeqsrw06&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/almyiprdy1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cp5qtxevcp"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=4zhypwnm&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=sficgo6n&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=soiybkrq&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hklifuye7q?signature=newsletter&amp\;amp\;trackingid=v2izthgeggs2ontblne93wojyanti2dz"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j6la6tjeil?signature=newsletter&amp\;trackingid=ikxy5w2prwakarovqzyjf5lsipf1elqt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jcyrtlrlqf?trackingid=dikwswiz&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k78cpcjb9y?https://webmail.spectrum.net/mail"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lw5kd2y1yg"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ndr3euzftx"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=kpdqhnid-d2?trackingid=ub8f4520&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=leovdeob-hu?trackingid=xplu2ju0&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=vrllwvpk-78?trackingid=cnr8reb5&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xlp6ftab-dk?trackingid=86sfocz4&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xth3uugp-ly?trackingid=3xaexyou&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oc8dgzpvag?type=news_sduwftmbmgintfa&amp\;page_id=141"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pw7pa4xm5s"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rpwvxkwbno"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rqcv9sn2pt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uqjhuzcwqg?trackingid=xqyal3bj&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/z3gsth5xgs"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200054213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mham"; http_uri; nocase; content:"t.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200054214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/+pg0whvxoqzgzmdg0"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dary_gerald_1"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/franklinscott23"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fxcryptotradegrouphelp"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/irs_agency"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/irsagencies"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/click_pixel?et=c&amp\;ago=212&amp\;ao=546&amp\;aca=26737887&amp\;si=7192763&amp\;ci=161117887&amp\;pi=317760010&amp\;ad=512366295&amp\;sv1=[keyword_id]&amp\;advt=4470646&amp\;chnl=-7&amp\;vndr=115&amp\;sz=6585&amp\;u=red=https://0g09rebqe8ms76om9oaq8oemd1t066ke0j725els0lpmpclkoh54heg.siasky.net/#test@mmhe.com.my"; http_uri; nocase; content:"t.myvisualiq.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200054221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tt/e2272313295849e1c619639a76f215659913d352/65c305586540d3917cefcff599131525/8224260473aa015a9ef229ec61963929/meqttm.com#dtovar@todo1.com"; http_uri; nocase; content:"t.yesware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahoooooooo"; http_uri; nocase; content:"taplink.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200054223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html"; http_uri; nocase; content:"tecsuport.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200054224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post_48.html"; http_uri; nocase; content:"telenorkandklimsupoort.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?shiny"; http_uri; nocase; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript"; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript/cmd-login=4d79dcadcdf578dd55b5358136707645/?reff=zjlhoguymmuwndzhytriywy1mdi3zjblyzq4zmzkzje="; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript/cmd-login=6d534ddb031fd3806a7fd8b85505c292/"; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript/cmd-login=8e624428269b1e296f49085bd6b42d28/"; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/dhl/dhl_topscript/cmd-login=bf1cb33ddcf84c331b084dda24cc111c/"; http_uri; nocase; content:"tggworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/m/i/"; http_uri; nocase; content:"theflexstudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/thegem/fonts/elegant/hub/navyfederal/"; http_uri; nocase; content:"thefunsport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5cgfd"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200054234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owes09"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200054235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2s37aper"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/audumx"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing6288"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing6588"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing8478"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing9488"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ingdirect738"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pty4by"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200054243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/39388cx8"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4c4acdec"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4hbvuu8c"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4ncwv5dj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4nwnbpxa"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4w683ws2"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/59rb3hv8#job@mup.cz"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5hy64u7t"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3bf544"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accessobperweb"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/asdd2022"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbanca"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbanca2022"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbancaaccessoclienti"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bperbancaweb"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cp-mxtoqul"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cp-npkctry4w"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cp-ouy88by"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/docu1fax"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/domain-webmail"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-rg4nexv"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-1raku3v"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-dkynk8j2t"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-jgwqcwfnjv"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-mhe0ohp9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-qqp3vta2"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-rtkhnnwu"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-vbhhyp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-xixqr6i9b"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-x1bbcdq7ey"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form-i1tknpeygn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form-xlpgrzzs"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hccf5vup"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issues-sr6ibhmquw"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issueslagv3a"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/issuestygtxz"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-4hg3l1btr"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-dqd86ubhbq"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-flkzbx1s3f"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-hijw94ctlf"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-lfxes1fttl"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-odmnerxjsg"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-osgfshdnaa"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-srr085p"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-stowq7oxj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-t2zgxdx9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-umnwdly"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-y6ftsfwn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-yafbicqxn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p45jfd7"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pag202210"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pag203masj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yc24jz87"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yc25p8dh"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yettf66x"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ysz7z7zc"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indexs%20(8).html"; http_uri; nocase; content:"tlecorp03802.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home-express/tracking-ch/login/index.php?trackid=cs471210241de#b2ea8635a661b25bc"; http_uri; nocase; content:"tqn.fbp.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1612678003989072-e5f6d8cc-499b-ea4f-85f1-8b23ad935661/1612677988/2f5895837f8d3f0a667c6b92ad41f652/8af273ac431e289838c8bf7c490185f3/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1614590779401122-8e06125c-4b23-d643-3068-601cab9bec04/1614590763/2f5895837f8d3f0a667c6b92ad41f652/31367888a66bf6f98973a200c83075bb/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c/?bn=35405429\;cpdir=https://tmmny.csb.app/.wewrewew.ahr0chm6ly9pbnzlc3rpbmdpbmdvzc5vcmcvqvbjmjq3.yw1izxiuzml0dg9uqhnwyxjrlmnvlm56"; http_uri; nocase; content:"track.adform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200054304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5022136/c?p=x5oidfhz2ouxhklaeegsdp9s1gfirlzjghcqduq9hhg14modcqwps7jwscfrdgzmzdelisqni_uf_ote8n4hr1lfku8fmxwxxrlkbis-61qncxwmoudp0aixd8q2rizn6crwltqa4h03cpp0xn_mtdnq9uswzoylgk1aevcq8fk="; http_uri; nocase; content:"track.smtpsendemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webapp/tribratanews/public/js/hughesnet.com/index.php"; http_uri; nocase; content:"tribratanewsbondowoso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ls/click?upn=rh-2bf9hqggd83zvr8-2f2urpq9jza4nfyepanu7d3q3phc5fuhcmko-2bdnkpb77-2frn0jksb4_12auc2qfc-2fmvanj9w5gz1niyn6w81nfyizixxcjyohcdjetmz8z7ozsg5qrzrqqfo70kk0rjxowq28q5nzx71p4rno1y2borqqazxmt0955ioulj3hotvbzkpo8pa09ilfa4l4xjki0vdirect7fh-2btqojn5nn-2bsvj56b8oj6ytisepl-2fyndoytlygbqfjcsnzj7xrxpcpc2y33v-2brcfmdaa-2fuzaljxshizppw79wtya017swhsi773accxnrksgojupnndhln5rwkqefr00pg-3d-3d"; http_uri; nocase; content:"trk.klclick3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ls/click?upn=vj3dadlrp-2fcfi22cxv5slmj9bs27v4ur9e-2f6aekkiuju7zruatjxol6lgt5xi6fx6lhwu7l9t0cxeulddiovrbyfpra1wztkgpi63kwkws-2bmvhmxfgmb6yn7jskx-2fu4r03dky7iafgb-2fta6hwqby63ucxfknnix2s1jtelfxd3wiwwlifn0vjgeal5ujbmupx8bbjcxvchr1ok8xfrqfnmy836ctsoh-2flt3d7uovnjooazs9eprx4wedfnmn7-2ffobhap4tt4pl-2f8q2poovn5cgshg-2fbbipi0gmepwr3skurvpjwgiyerch1vtr9yyrov5bbgjn-2fvhfiffsnaqi5bca-3d-3dkqpr_0ivmhd7nsoe2up5tze3op8d-2fsn3ohure6d19gi8qjbwosimpdtamk7y8urnfbq0eurrturkgyz8ptfq84s0oghdjaey4eqygfme-2fornmqugxkvuhwavsrvpuyd6j3ehclftk-2fmhytlzdz4wv4ecss4tpqsttkgejqscggvgnl9s16ulwcz4ssvrqiuim0snvj2i6p8dzv6clywsguhbw5yjht4b08ursgrgxp0j7nmkuf93odmq9xwbxnuqp-2bry65pnu-2frpphtuvgjsa8tolngsbb8jnsy6mjxkfnkxn672ryzlksl-2bcvphralufouhwimybzdacvpo13oxjwigqqcoyv2yfewxdqtphaydrskcereezuvegylv3m76xouvyyowqnmkdh13-2bfz01-2bqnsuw-3d-3d#amfwzxjlekbiyw5jb29wlmnvbq=="; http_uri; nocase; content:"trk.klclick3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81ad8277-2641-4559-9924-3226fff1aeb8?lm_sub=4183&lm_list=gmail_cleaned&lm_shoot_mode=manual&lm_version=8201&lm_id=mlacys97%40gmail.com&lm_age=22%2f08%2f1964"; http_uri; nocase; content:"tuntine-resport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b9sm"; http_uri; nocase; content:"twixar.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hcsm"; http_uri; nocase; content:"twixar.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200054311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_sglha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/asjuha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cdxnha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hdfkha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kaltha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mxztha?/confirm-account"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qgxnha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v6ltha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ysxtha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/jmlee_ucmo_edu/ey4vifgt_7nfmz9xrsc5lpcbyiu2dkrhyz1vcu3pcml_la?e=4%3advzg7b&amp\;at=9"; http_uri; nocase; content:"ucmo0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2jtcaszcsaza/click-here-to-verify-your-email"; http_uri; nocase; content:"unigeol.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/000"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail2022"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nudi"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?byzfzh01a8agnrfkn2qmyujcvyce3awstvjvfvza8k7z-mi7uoyekfwkp0v6uia5gksaqub2jvcrtkxzypflbtm3dvnmhilt5onpcy2165mweqkphha5rbmbyvrk68yts"; http_uri; nocase; content:"url.emailprotection.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200054326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/result/d20ea0a6-903f-46c2-9377-ac533812b1ad/"; http_uri; nocase; content:"urlscan.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200054327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/redirect?url=https://siasky.net/pal-9jprh79gg30kow2xqyifnwh-z9lrxbfnfer9y46lwg#webmaster@cuni.cz"; http_uri; nocase; content:"urlstat.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200054328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_r1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200054329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_y1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200054330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic37"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvb?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvj?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iqe0"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jjwm"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jkml"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200054336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/au4zs"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dbgei"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g8zxv"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x6pbm"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/contact-form?u=a08b8fa7dc281a5b052ab3d7e&amp\;form_id=cf82998934d3892f4062e1fa338e95e4"; http_uri; nocase; content:"us11.list-manage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lm53"; http_uri; nocase; content:"usnd.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200054342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2gfq?facebook_secu%c9%beity_report="; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2nitw?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abqe"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbjiy?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d0bv?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e4ea?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gsig?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kvisr?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kvjh"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/midb?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n5j4d"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s7zj?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vymxy?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wdhoz?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xonp?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200054357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcceaririccrasoria.viiessvaaciraoccivraoeaosonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicaceessaivcveaririacrsior.avisievseaaciccovsaoeaosesoeosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaaacircovsiaoeaosesseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririacrsior.avisievsaacciovosioeaosesonosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieascaccivsoioeaosesonssiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacessvaivcceaririscri.orvaisvieaseaccivsoioeaosesonssiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevscaivcaeaririicr.voriasvaiecsvasciiooaoosesonseoren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivccearirivcrcaorsai.vieissaacirvoeaicrciaoeaesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevseaivcsearirivcrcaorsai.vieissavcioeoaccvraoeaosonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaicacevssaivcveaririccrasoria.viiessvaacioeocvsaoeaosesseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaiccairccrasoria.viiessvaaciraoccinivraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairacrsior.avisievseaaciccovsinaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccesaicvairccrasoria.viiessvaaciococvinsaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaaacircovsiniaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairacrsior.avisievsaacciovosiiaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieascaccivsoioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccsvaiccairscri.orvaisvieaseaccivsoioaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvcaicaairicr.voriasvaiecsvasciiooaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaiccairvcrcaorsai.vieissaacirvoeainicrciaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccveaicsairvcrcaorsai.vieissavcioeoacincvraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaiccairccrasoria.viiessvaaciraoecinivraoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.bcruiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.dtrjwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.fsxvtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.korhyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.myxbtu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vaiccvsaicvairccrasoria.viiessvaacioeocvinsaoeaosesonseosiren.xfemiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ch/portal/redsys.html"; http_uri; nocase; content:"validationpacket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiceeesacvciracrsior.avisievseaaciccovsinaoeosnmer.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veisceseccavccrirasoiar.viessvacraooaccnirvaoneosenmserc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaccarirsio.arvisevseacccooavsaoreosnnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscesecvaeccrirasoiar.viessvacocooacvnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveascccvsooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaacsriri.ovarisveaseccvsooaaoeorsnmneresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaccarirsio.arvisevsaacrcooavsnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscsveccaecarirsio.arvisevsaccovooasaoerosnnmeresc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvcecaascirir.voiarsvaecsvscioaooeosnrmernesc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveeccascvrircaosari.veissacrvooaeanircrcnaoeeossnmerc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscveecsaecvrircaosari.veissvcoeooaacncrvaoneosenmserc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.lzpytu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvseccavccrirasoiar.viessvacraooaecnirvaoneosenmserc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.fajubu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.gelxdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"veiscvsecvaeccrirasoiar.viessvacoeooacvnaroeonsnmeersc.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhcb.imr/process.php"; http_uri; nocase; content:"ventdoctorclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhcb.imr/process_nr.php"; http_uri; nocase; content:"ventdoctorclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhcb.imr/process_rn.php"; http_uri; nocase; content:"ventdoctorclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nhcb.imr/signin.php?authorization.oauth2?client_id=bxrx7egs7tui0ij1o0cqrz6wo45jafcrfzwjx2af82fksidszepdp6to4qchquehxnvygc6bkmfzlqlh&response_type=code&scope=openid%20profile%20email%20device%20ost.all%20sbg-card.all%20sbg-corecustomerplatform.all%20sbg-forex.all%20sbg-payment.all%20sbg-platform.all%20sbg-systems.all%20urn:pingidentity:directory-api&redirect_uri=onlinebanking.standardbank.co.za/auth/prompt=login"; http_uri; nocase; content:"ventdoctorclt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/689734/3489345346/"; http_uri; nocase; content:"verifyservices-contact.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaeeevesvcsceei.viacvacersvoerrsai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaaveesevcesei.vivcacsveersaoir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesavceei.vivcsvcesairaser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaeveesvcceei.vivacscversrai.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavceesevcesei.visvacsveerasoir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaaveeecesvcsceei.viacsaversvoerrasi.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaavseevceei.vivcsvescair.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaeavesvcsceei.viavacesvoerrcsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavasevcesei.vivcasveesacoiras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavcseevceei.visvsveacsir.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesavceei.visvsvceasiraser.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveceesvcceei.visavscverarsi.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaaveseevacei.vivsvesicaserr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaavsveecei.vivsvesicr.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viacsevcesei.visvasvceeaso.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaecesvcsceei.viasavesvcoerra.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseccai.vivccvcveaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseccai.vivccvcveaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseccai.vivccvcveaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseccai.vivccvcveaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseceeai.vivccvceaaaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseceeai.vivccvceaaaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseceeai.vivccvceaaaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaeevseceeai.vivccvceaaaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevasvcceei.vivacsvercsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaevesvcsceei.viavacesvcoerrs.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevsecai.vivcvcvaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevsecai.vivcvcvaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevsecai.vivcvcvaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevsecai.vivcvcvaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevseeeai.vivcvcaaaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevseeeai.vivcvcaaaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevseeeai.vivcvcaaaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaevseeeai.vivcvcaaaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaecai.vicvcvecveaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaecai.vicvcvecveaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaecai.vicvcvecveaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaecai.vicvcvecveaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaeeeai.vcivcevceaaaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaeeeai.vcivcevceaaaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaeeeai.vcivcevceaaaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaieevscaeeeai.vcivcevceaaaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaeeesvi.cvsceveeaaavis.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaevsvi.vcscveeveavsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaevsvi.vcscveeveavsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaevsvi.vcscveeveavsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaiesvccaevsvi.vcscveeveavsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaecai.vivcvcveaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaecai.vivcvcveaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaecai.vivcvcveaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaecai.vivcvcveaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaeeeai.vivcvceaaaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaeeeai.vivcvceaaaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaeeeai.vivcvceaaaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaievsaeeeai.vivcvceaaaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaeeesvi.vscveeaaavs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaeeesvi.vscveeaaavs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaeeesvi.vscveeaaavs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaeeesvi.vscveeaaavs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaeeesvi.vscveeaaavs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaevsvi.vscveveavs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaevsvi.vscveveavs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaevsvi.vscveveavs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaevsvi.vscveveavs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viaisvcaevsvi.vscveveavs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post.html"; http_uri; nocase; content:"viamobte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcviioerscznrem.vsosieovsismsivi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viaseesxcvoerscznrem.vsosieovsismscvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevceceesvi.vsccveeaaavsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevceceesvi.vsccveeaaavsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevceceesvi.vsccveeaaavsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevceceesvi.vsccveeaaavsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevcecvsvi.vsccveveavsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevcecvsvi.vsccveveavsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevcecvsvi.vsccveveavsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasevcecvsvi.vsccveveavsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvceeesvi.vscveaaavs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvceeesvi.vscveaaavs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvceeesvi.vscveaaavs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvceeesvi.vscveaaavs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvceeesvi.vscveaaavs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvcevsvi.vscvevavs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvcevsvi.vscvevavs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvcevsvi.vscvevavs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvcevsvi.vscvevavs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viasvcevsvi.vscvevavs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavcasevcesei.visvasveeascoiras.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viaveacesvcsceei.viasavesvoerrcasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"viavsavceei.vivcsvecsaias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vicvcsecresseevei.cveversavesi.ptpcdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieanioineeicure.visorcoersnsvxmaenercmsvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeiscvoersznrem.vsosiovsivesmenscvoiei.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeisviioenem.vsosirvvenismesivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieaseeisviiooizxrem.vsosivsveneenismsivi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vieoesrinceieosnv.vsoersorcnsivmvrenerescvi.yhzjku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/633ffa327675d0001804bca1"; http_uri; nocase; content:"view.genial.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200054693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"vinted-pl-gj32d.dedelu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"vinted-pl-gj32d.ronghu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"vinted-pl-gj32d.tangku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1662975258698217"; http_uri; nocase; content:"vinted-pl-gj32d.uttu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvaoesnsiera.vocasccosucvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssasnoiwzxera.vocasccoensucvoiei.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vioinvssxaoesnsrscoiwzxera.vocaseocenosunvi.fmstks.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200054700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsoiesiver.o.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoiceeesiver.cea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoiceeesiver.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visacsvoieesiver.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevescseiver.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevessiver.a.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvcsoeissiver.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesceseiver.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visaevvesseiver.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"visavevsiceveer.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viseoscai.vscsaeeicso.uqmzwu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevacsrccvncvsa.viveaseroseevcavrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevccsrvcnvsa.vivsvcaseroveeenavci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvevcvcnvsa.vivsvcveeenavci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssacsrvccacsevi.vieaseroveeevacrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssavccacsevi.vieveeevacrvnvsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvccasevi.vivevceevnavsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvssvcsrccasevi.vivevaseroceevnavsa.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvaccvecnvci.vieveecaaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvacsrccvecnvci.vieaseroveecaaarsenvs.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"visvsvccsrvcenvci.vivcaaseroaeeseanvs.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/p/quilted-hobo-bag-versace-jeans-couture-bag-1588730/"; http_uri; nocase; content:"vitkac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcavaesevai.sa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveescvai.saa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcaveescvai.saa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevacreasecvai.saoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevacreasecvai.saoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevecrsavaci.soaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceaevecrsavaci.soaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivceavareasecvai.sao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.idqaku.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200054739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivcsavceei.visvsvecasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreesecei.vcieeaaevesi.exmrhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreesecei.vcieeaaevesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreisevei.vcieesiavesi.exmrhu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivcssecreisevei.vcieesiavesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200054746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivecasvcceei.visavsvercasias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevaarvasecvsi.eao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveevaarvasecvsi.eao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveaacrvasecvsi.eaoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"viveeveavcrsavsci.eoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvccai.vivscvcveaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvccai.vivscvcveaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvccai.vivscvcveaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvccai.vivscvcveaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvceeai.vivcsvceaaaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvceeai.vivcsvceaaaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvceeai.vivcsvceaaaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viveevsvceeai.vivcsvceaaaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaavsevsi.ea.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaavsevsi.ea.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaccsrvncvsa.vivesvaserocvrenvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevacvncvsa.vivesvcvrenvci.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevaevscvsi.eaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevavsvsi.e.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvcsrnvsa.vivsvcveaseronvci.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivevcvcsrnvsa.vivsvcveaseronvci.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsvcai.vivsvcvaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsvcai.vivsvcvaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsvcai.vivsvcvaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsvcai.vivsvcvaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsveeai.vivsvcaaaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsveeai.vivsvcaaaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsveeai.vivsvcaaaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivevsveeai.vivsvcaaaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscavcai.vicvsvecveaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscavcai.vicvsvecveaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscavcai.vicvsvecveaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscavcai.vicvsvecveaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscaveeai.vcivsevceaaaeii.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscaveeai.vcivsevceaaaeii.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscaveeai.vcivsevceaaaeii.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivieevscaveeai.vcivsevceaaaeii.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaieesvi.cvsaeveeaasvis.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaivsvi.vcsaveevesvsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaivsvi.vcsaveevesvsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaivsvi.vcsaveevesvsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"viviesvccaivsvi.vcsaveevesvsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsavcai.vivsvcveaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsavcai.vivsvcveaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsavcai.vivsvcveaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsavcai.vivsvcveaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsaveeai.vivsvceaaaei.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsaveeai.vivsvceaaaei.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsaveeai.vivsvceaaaei.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivievsaveeai.vivsvceaaaei.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaieesvi.vsaveeaasvs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaieesvi.vsaveeaasvs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaieesvi.vsaveeaasvs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaieesvi.vsaveeaasvs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaieesvi.vsaveeaasvs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaivsvi.vsavevesvs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaivsvi.vsavevesvs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaivsvi.vsavevesvs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaivsvi.vsavevesvs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivisvcaivsvi.vsavevesvs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsocieesesia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacsoiesesia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoceieesesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsacvsoieesesia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavesceesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavvesceeesia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsavveseesia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscsecreisvei.vicveesivesi.wetot.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200054826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivscsecrevseci.vicveeaveesi.zxpdbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavecsesesia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivseavvesesesia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcarvaaecsei.aao.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcarvaaecsei.aao.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevciceesvi.vscaveeaasvsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevciceesvi.vscaveeaasvsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevciceesvi.vscaveeaasvsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevciceesvi.vscaveeaasvsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevcicvsvi.vsacvevesvsi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevcicvsvi.vsacvevesvsi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevcicvsvi.vsacvevesvsi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsevcicvsvi.vsacvevesvsi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevcvraaseci.ao.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecacrvaaecsei.aaoaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecvcraaseci.aoaa.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsevecvcraaseci.aoaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssavcsrcacsevi.vieveaserovcrvnvsa.xmvywu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivssvccsrasevi.vivevcvaseronvsa.ddglku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.doobbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.efxadu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.iddr8.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200054849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.ufsheu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.ylukru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vivsvacei.vivsvcesias.zxgyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.idenyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvacvecnvci.vievcaarsenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvceavcaesei.aaaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvceavcaesei.aaaa.ranzlu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcevacsei.aaa.pkvtcu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcieesvi.vsaveaasvs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcieesvi.vsaveaasvs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcieesvi.vsaveaasvs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcieesvi.vsaveaasvs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcieesvi.vsaveaasvs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcivsvi.vsavevsvs.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcivsvi.vsavevsvs.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcivsvi.vsavevsvs.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcivsvi.vsavevsvs.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vivsvcivsvi.vsavevsvs.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvasei.a.fnfkau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvcsrenvci.vivcaasaseroenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwbrvz8quj/page1.php"; http_uri; nocase; content:"vivsvcvenvci.vivcaasenvs.ikmqvu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=ccugr"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f35.229.41.22?key=n4jki,email=email@icloud.com&post=11231_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fhumanity06.com%2fwp-content%2fthemes%2fapi.html"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2firsgov-refundprogram.online%2f%3fverify"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://168.61.163.101/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.1.185.241/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=a0j3o,email=kminella@icloud.com&post=13847_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=mk9z6,email=lupekerber@yahoo.com&post=82701_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=e86i8,email=email@icloud.com&post=52917_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=ujas3,email=email@icloud.com&post=95993_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.73.46?key=rpgvc,email=email@icloud.com&post=35214_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=email@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=kminella@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.121.2.22/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=bekja,email=kimberlidismuke13@icloud.com&post=98876_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=dlqg7,email=email@icloud.com&post=88353_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=ffiqb,email=email@icloud.com&post=65185_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=tqayb,emai=email@icloud.com&post=01286_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=wuhq2,email=mariareyes7826@icloud.com&post=15402_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.164.95?key=jdlwh"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.46.217?key=bgckvctutk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.49.9/?key=voqj5,email=durincat8@icloud.com&post=19202_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=rtudqaeeba"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=skfefvlukk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.35.247?key=iguhqpukhn"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.229.141.100/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.230.50.243?key=uyffw,email=email@sbcglobal.net&post=87074_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.239.152.26/index.html?key=oppca,email=irs.government@icloud.com&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.39.209.90?key=hcirs,email=email@icloud.com&post=94243_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=0uqyr,email=email@yahoo.com&post=94707_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=sbjxm,email=email@yahoo.com&post=31496_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=gojjs,email=email@icloud.com&post=65211_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=hiumv,email=golder.cm@icloud.com&post=58507_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=ihwbn,email=email@icloud.com&post=01341_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=qba0d,email=email@icloud.com&post=85453_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=ejkco,email=dlighted@icloud.com&post=16970_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=nn7jd,email=email@icloud.com&post=71936_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=pcah4,email=email@icloud.com&post=58184_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=1g3zv,email=email@icloud.com&post=71118_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=7opkq,email=dylanmarilyn@icloud.com&post=19298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=bs0x8,email=email@icloud.com&post=97474_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=dtruh,email=email@icloud.com&post=48614_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=m4rhr,email=email@icloud.com&post=09923_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.77.66.21?key=nc14b,email=ebynum84@icloud.com&post=99099_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=dlykh,email=samantha.adams76@icloud.com&post=04213_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=pj3yz,email=email@icloud.com&post=67421_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.117.61.134/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.77.6.54?key=oppca"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.82.145.107?key=nr1yf,email=nccollis@icloud.com&post=15853_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.87.142.94?key=mgpnmfsjjt"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://51.12.50.209?key=vkmgm,email=samyafinley@icloud.com&post=27530_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.14.205.198?key=qu11c"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=8s5yy,email=jhnpaul@icloud.com&post=99298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=pjway,email=tkey8@icloud.com&post=45230_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fartesvladshiola.com%2f.well-known%2fpki-validation%2fsondu%2fkomuter&post=696668869_33&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fedelwiral.info%2fwp-includes%2fsodium_compat%2fnamespaced%2fcore%2fcurve25519%2fgose&post=696668869_17&cc_key=/?xjxiixmi-suirs70143986"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2femtowersgroup.com%2fwp-admin%2fimages%2fgrak%2fsus&post=696668869_19&cc_key=/?uccxgwww-kampo32395997"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2frdx-federal.com%2f&post=710109641_2"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2ftempt.lk%2fhosr&post=696668869_21&cc_key=/?hbijqrvf-mom71222564"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fwolffun.net%2fwp-includes%2fwidgets%2fxloa%2fclose%2f&post=696668869_14&cc_key=/?xoxlosml-usa34359382"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://7chavesdoprazer.site/wp-includes/css/apicayyx.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://amrutimba.com/css/api.php?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://dashtipour.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://egyptvespa.com/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key="; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://forextradingtruth.com/wp-includes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://gociate.com/wp-content/acayganz.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://greyhillconsulting.com/assets/css/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://grocerypanna.com/wp-admin/user/apito.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&amp\;post=%7brandom_number_5%7d_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://hayvanatbahcesi.net/wp-admin/includes/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://jindalbuildcon.com/wp-includes/assets/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/img/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/include/apiacy.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://maxvaloan.com/wp-includes/js/api-gantengcuy.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://mumnbebe.com/wp-includes/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://naturesbuffet.co.in/api-lrsbaru.html?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://neonamsterdam.com/wp-admin/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://pyxcapital.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=nfhjn,email=email@email.com&post=47493_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=zza21,email=email@email.com&post=39704_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://serv.jembudirenkgk.com/sple/sadjhfjhcuic?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://srv.remaikerea.com/apa/wisedanlah?key=dvnd3,email=apohlmann@icloud.com&post=60667_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://themagone.com/wp-admin/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://trimsx.com/wp-includes/assets/api.html?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://twitter.com?w5htjopplcko0cun0kky&cc_key=?trackingid=o9xc3cyu&signature=newsletter"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://wpcdecor.com/wp-includes/acy-ling.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.alkorplan.de/wp-admin/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ciudadanoseguro.cl/wp-admin/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ciudadanoseguro.cl/wp-content/themes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.mathelin-teinture-tissus.com/assets/include/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.mathelin-teinture-tissus.com/assets/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.newlifenursery.com/assets/rdt.html?key=lwhi1"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.sinergy.io/wp-includes/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.thaitheparos.com/assets/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.ulicapolska.pl/public/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://yavuzhanotel.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200054967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeaiv.vicacveeveaasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeaiv.vicacveeveaasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeaiv.vicacveeveaasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeaiv.vicacveeveaasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaieivscaeeeiv.vciaceveeaaaais.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievsecaiv.viaccveveaasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievsecaiv.viaccveveaasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievsecaiv.viaccveveaasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievsecaiv.viaccveveaasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievseceeiv.viaccveeaaaasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievseceeiv.viaccveeaaaasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievseceeiv.viaccveeaaaasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaievseceeiv.viaccveeaaaasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeaiv.viacveveaas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeaiv.viacveveaas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeaiv.viacveveaas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeaiv.viacveveaas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeaiv.viacveveaas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeeeiv.viacveeaaaas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeeeiv.viacveeaaaas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeeeiv.viacveeaaaas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeeeiv.viacveeaaaas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaiivsaeeeiv.viacveeaaaas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseaiv.viacvevaas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseaiv.viacvevaas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseaiv.viacvevaas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseaiv.viacvevaas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200054999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseaiv.viacvevaas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseeeiv.viacveaaaas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseeeiv.viacveaaaas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseeeiv.viacveaaaas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseeeiv.viacveaaaas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsaivseeeiv.viacveaaaas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vscaoseaaaseri.vsaccavaeorair.hjjpju.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5609h-45jtg-wrkef-wker-gf9jew9r5tgj-wfj-w9jr-g9j9jd.html?awsaccesskeyid=ry9rplphuuep0rwre8s8&expires=1665594150&signature=iowswak2a3xryhmtfsdti1fjwli=#user@domain.tld"; http_uri; nocase; content:"vsv-dvb34ebr5-g0-3ker0-vgm-wernmv-9rn-n-9n.obs.sa-brazil-1.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5609h-45jtg-wrkef-wker-gf9jew9r5tgj-wfj-w9jr-g9j9jd.html?awsaccesskeyid=ry9rplphuuep0rwre8s8&expires=1665594150&signature=iowswak2a3xryhmtfsdti1fjwli%3d"; http_uri; nocase; content:"vsv-dvb34ebr5-g0-3ker0-vgm-wernmv-9rn-n-9n.obs.sa-brazil-1.myhuaweicloud.com:443"; content:"Host"; http_header; classtype:attempted-recon; sid:200055008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoicseavcia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsoisavcia.o.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiseavcia.oea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvecsvoiseavcia.oea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevcscoeiasvcia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsacsevcia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevsasvcia.a.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsasevcia.aea.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsveevvsasevcia.aea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcceia.c.edtsiu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsavcceia.c.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k7oimyjheu/page1.php"; http_uri; nocase; content:"vsvevsvavceceia.cea.tncjmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscacaiv.vicasveevesasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscacaiv.vicasveevesasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscacaiv.vicasveevesasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscacaiv.vicasveevesasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.gdxsmh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvieivscaceeiv.vciaseveeaasais.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievsccaiv.viascvevesasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievsccaiv.viascvevesasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievsccaiv.viascvevesasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievsccaiv.viascvevesasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievscceeiv.viacsveeaasasi.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievscceeiv.viacsveeaasasi.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievscceeiv.viacsveeaasasi.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvievscceeiv.viacsveeaasasi.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsacaiv.viasvevesas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsacaiv.viasvevesas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsacaiv.viasvevesas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsacaiv.viasvevesas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsacaiv.viasvevesas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsaceeiv.viasveeaasas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsaceeiv.viasveeaasas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsaceeiv.viasveeaasas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsaceeiv.viasveeaasas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsviivsaceeiv.viasveeaasas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivscaiv.viasvevsas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivscaiv.viasvevsas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivscaiv.viasvevsas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivscaiv.viasvevsas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivscaiv.viasvevsas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivsceeiv.viasveaasas.gjkguu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivsceeiv.viasveaasas.idolba.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivsceeiv.viasveaasas.wrpvyu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivsceeiv.viasveaasas.xjsfmu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/laucvx4r/page1.php"; http_uri; nocase; content:"vsvivsceeiv.viasveaasas.zteusu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200055058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeigw5jlwvykqqwfwiz7bykja2imjyes2ouyl57dd33vpydeip4efgy/30093a.shtml"; http_uri; nocase; content:"w3s.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200055059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o2/a/f5s4y/0"; http_uri; nocase; content:"warriorplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/miziha/client/login.html"; http_uri; nocase; content:"web.ib.mizvhiback.co.jp.gjplt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/miziha/client/login_sp.html"; http_uri; nocase; content:"web.ib.mizvhiback.co.jp.gjplt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/explorer"; http_uri; nocase; content:"webdeficonnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/engagements.html?vital=rogelio_viesca@claro.com.do"; http_uri; nocase; content:"webmails.literhost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp/gkfksad/login.php?cmd=submit_log&id=mja5ndy0mtc1mw==mja5ndy0mtc1mw==&session=mja5ndy0mtc1mw==mja5ndy0mtc1mw=="; http_uri; nocase; content:"webprojectmockup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d"; http_uri; nocase; content:"webuyworkshopequipment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/"; http_uri; nocase; content:"webuyworkshopequipment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/company/banco-original"; http_uri; nocase; content:"weps.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200055070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_home"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_internet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_service_alert."; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_teem"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_update"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_upgrade"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@btinternet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@yahoo2022"; http_uri; nocase; content:"wlo.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200055078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/testing02"; http_uri; nocase; content:"wow.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200055079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#test@test.com"; http_uri; nocase; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200055080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/?serviceurl=/qudustemitope455/form/signinyourbtaccountcorrectly/share"; http_uri; nocase; content:"zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200055081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efrrqedv9fec#michael@.yorku.ca"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gn8bkuunkc6m"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kms8u47zlxwk"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mxvzwlcdizyq"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nckeqquhrpuf"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uyydv5mqujps"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200055087; rev:1;)